CVE-2026-124762 · Package
NO FIX YET · SEE WHAT TO DO
P-Net is a PROFINET device stack; before 1.0.4 it matches an incoming RPC reply only by its activity UUID, which is sent in clear. An attacker on the same network segment can send one crafted PDU to abort the Application Relationship, and can also create sessions or change stored session addresses.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Devices built on P-Net before 1.0.4 that accept PROFINET RPC traffic from the network. Exposure requires an attacker on the adjacent network who has seen the connection's activity UUID, which appears in clear in every RPC request. Systems that do not run P-Net, or that are isolated from adjacent hosts, are not affected.
Not affected if isolated-network, p-net-1.0.4-or-later
Who cares embedded, industrial-control, p-net, profinet
p-net library version in the project's dependencies1.0.41.0.4 or laterP-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes from. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can abort the Application Relationship with one PDU. It also allocates a session for an unknown activity UUID and changes the address stored for an existing session.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.