---
id: "CVE-2026-124762"
page: "https://infrastack.ai/live/CVE-2026-124762"
kind: "vulnerability"
aliases: ["CVE-2026-124762"]
title: "P-Net: forged RPC reject or cancel PDU aborts PROFINET device connections"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "industrial-control", "p-net", "package", "profinet"]
not_affected_if: ["isolated-network", "p-net-1.0.4-or-later"]
published_at: "2026-11-13T14:17:50+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124762", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# P-Net: forged RPC reject or cancel PDU aborts PROFINET device connections

Link for people: https://infrastack.ai/live/CVE-2026-124762 (this .md is for agents)

P-Net is a PROFINET device stack; before 1.0.4 it matches an incoming RPC reply only by its activity UUID, which is sent in clear. An attacker on the same network segment can send one crafted PDU to abort the Application Relationship, and can also create sessions or change stored session addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the P-Net version in the firmware or build of the PROFINET device, e.g. the `p-net` library version in the project's dependencies
- Confirm whether the device runs P-Net builds before `1.0.4`

## Fix

- P-Net: upgrade to `1.0.4` or later

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124762

## From the sources

P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes from. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can abort the Application Relationship with one PDU. It also allocates a session for an unknown activity UUID and changes the address stored for an existing session.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_