{"id":"CVE-2026-124762","kind":"vulnerability","aliases":["CVE-2026-124762"],"related":[],"title":"P-Net: forged RPC reject or cancel PDU aborts PROFINET device connections","description":"P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes from. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can abort the Application Relationship with one PDU. It also allocates a session for an unknown activity UUID and changes the address stored for an existing session.","summary":"P-Net is a PROFINET device stack; before 1.0.4 it matches an incoming RPC reply only by its activity UUID, which is sent in clear. An attacker on the same network segment can send one crafted PDU to abort the Application Relationship, and can also create sessions or change stored session addresses.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-control","p-net","package","profinet"],"not_affected_if":["isolated-network","p-net-1.0.4-or-later"],"how_to_check":"- Check the P-Net version in the firmware or build of the PROFINET device, e.g. the `p-net` library version in the project's dependencies\n- Confirm whether the device runs P-Net builds before `1.0.4`","fix":"- P-Net: upgrade to `1.0.4` or later","status":"open","published_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:29+00:00","updated_at":"2026-11-13T15:21:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:21:29Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: upgrade to `1.0.4` or later","reach":"network","title":"P-Net: forged RPC reject or cancel PDU aborts PROFINET device connections","impact":"medium","summary":"P-Net is a PROFINET device stack; before 1.0.4 it matches an incoming RPC reply only by its activity UUID, which is sent in clear. An attacker on the same network segment can send one crafted PDU to abort the Application Relationship, and can also create sessions or change stored session addresses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["profinet","p-net","industrial-control","embedded"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker aborts industrial device connection with one forged PDU","analyst_note":"","how_to_check":"- Check the P-Net version in the firmware or build of the PROFINET device, e.g. the `p-net` library version in the project's dependencies\n- Confirm whether the device runs P-Net builds before `1.0.4`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["p-net-1.0.4-or-later","isolated-network"],"who_is_affected":"Devices built on P-Net before 1.0.4 that accept PROFINET RPC traffic from the network. Exposure requires an attacker on the adjacent network who has seen the connection's activity UUID, which appears in clear in every RPC request. Systems that do not run P-Net, or that are isolated from adjacent hosts, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4635,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124762':16A,19A '-2026':15A,18A '1.0.4':38B,86C 'abort':10A,68B,110C,158C 'access':138C 'activ':48B,97C,143C,173C 'address':81B,178C 'adjac':136C 'alloc':167C 'also':74B,166C 'answer':121C 'applic':70B,112C,160C 'attack':56B 'call':124C 'cancel':8A,105C 'chang':78B,176C 'check':115C 'clear':54B,152C 'come':131C 'connect':13A,147C 'control':23B 'craft':65B 'creat':75B 'cve':14A,17A 'devic':12A,35B,127C 'embed':20B 'everi':154C 'exist':182C 'fault':103C 'find':87C 'forg':4A 'host':134C 'incom':42B 'industri':22B 'industrial-control':21B 'match':40B 'net':3A,26B,31B,84C 'network':60B,137C 'observ':141C 'one':64B,163C 'p':2A,25B,30B,83C 'p-net':1A,24B,29B,82C 'packag':27B 'pdu':9A,66B,94C,106C,118C,164C 'profinet':11A,28B,34B 'receiv':93C 'reject':6A,102C 'relationship':71B,113C,161C 'repli':44B 'request':156C 'rpc':5A,43B,89C,155C 'segment':61B 'send':63B 'sent':52B,150C 'session':76B,80B,90C,109C,169C,183C 'stack':36B 'store':79B,179C 'unknown':172C 'uuid':49B,98C,144C,174C 'without':114C","nicknames":[],"mitigations":[],"who_affected":"Devices built on P-Net before 1.0.4 that accept PROFINET RPC traffic from the network. Exposure requires an attacker on the adjacent network who has seen the connection's activity UUID, which appears in clear in every RPC request. Systems that do not run P-Net, or that are isolated from adjacent hosts, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","industrialcontrol","medium","package","pnet","profinet"],"campaign_type":null,"search_a":"'-124762':16A,19A '-2026':15A,18A 'abort':10A 'cancel':8A 'connect':13A 'cve':14A,17A 'devic':12A 'forg':4A 'net':3A 'p':2A 'p-net':1A 'pdu':9A 'profinet':11A 'reject':6A 'rpc':5A","search_b":"'1.0.4':38B 'abort':68B 'activ':48B 'address':81B 'also':74B 'applic':70B 'attack':56B 'chang':78B 'clear':54B 'control':23B 'craft':65B 'creat':75B 'devic':35B 'embed':20B 'incom':42B 'industri':22B 'industrial-control':21B 'match':40B 'net':26B,31B 'network':60B 'one':64B 'p':25B,30B 'p-net':24B,29B 'packag':27B 'pdu':66B 'profinet':28B,34B 'relationship':71B 'repli':44B 'rpc':43B 'segment':61B 'send':63B 'sent':52B 'session':76B,80B 'stack':36B 'store':79B 'uuid':49B","search_c":"'1.0.4':86C 'abort':110C,158C 'access':138C 'activ':97C,143C,173C 'address':178C 'adjac':136C 'alloc':167C 'also':166C 'answer':121C 'applic':112C,160C 'call':124C 'cancel':105C 'chang':176C 'check':115C 'clear':152C 'come':131C 'connect':147C 'devic':127C 'everi':154C 'exist':182C 'fault':103C 'find':87C 'host':134C 'net':84C 'network':137C 'observ':141C 'one':163C 'p':83C 'p-net':82C 'pdu':94C,106C,118C,164C 'receiv':93C 'reject':102C 'relationship':113C,161C 'request':156C 'rpc':89C,155C 'sent':150C 'session':90C,109C,169C,183C 'store':179C 'unknown':172C 'uuid':98C,144C,174C 'without':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124762","severity":null,"published_at":"2026-11-13T14:17:50+00:00","modified_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}