{"id":"CVE-2026-127122","kind":"vulnerability","aliases":["CVE-2026-127122"],"related":[],"title":"P-Net: unchecked multicast request blocks overflow memory on Profinet devices","description":"P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected.","summary":"P-Net is an open-source Profinet device stack used in industrial controllers. A Connect request with more multicast communication relation blocks than the array holds writes past the array end, letting a nearby attacker corrupt adjacent memory with request-supplied data.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-control","p-net","package","profinet"],"not_affected_if":["non-adjacent-network","pnet-1.0.4-or-later","pnet-option-mc-cr-disabled"],"how_to_check":"- Check the P-Net version in the build: fewer than `1.0.4` is affected.\n- Check whether the build defines `PNET_OPTION_MC_CR`; builds with it disabled are not affected.\n- Check whether `PNET_MAX_MC_CR` is set, since the default is `1`.","fix":"- P-Net: move to `1.0.4` or later.","status":"open","published_at":"2026-11-13T14:17:54+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:15+00:00","updated_at":"2026-11-13T15:21:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:21:15Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: move to `1.0.4` or later.","reach":"network","title":"P-Net: unchecked multicast request blocks overflow memory on Profinet devices","impact":"high","summary":"P-Net is an open-source Profinet device stack used in industrial controllers. A Connect request with more multicast communication relation blocks than the array holds writes past the array end, letting a nearby attacker corrupt adjacent memory with request-supplied data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","industrial-control","embedded"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker writes request-controlled data into adjacent memory, possibly code execution","analyst_note":"Confirm the affected component's registry and whether a fixed release beyond 1.0.4 exists, from the NVD and the P-Net repository.","how_to_check":"- Check the P-Net version in the build: fewer than `1.0.4` is affected.\n- Check whether the build defines `PNET_OPTION_MC_CR`; builds with it disabled are not affected.\n- Check whether `PNET_MAX_MC_CR` is set, since the default is `1`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["pnet-option-mc-cr-disabled","pnet-1.0.4-or-later","non-adjacent-network"],"who_is_affected":"Only devices built on P-Net before 1.0.4 with the multicast communication relation option enabled are exposed. The attacker must be on the same local network segment, and no established Application Relationship is needed. Builds with PNET_OPTION_MC_CR disabled can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4626,"output_tokens":639,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127122':15A,18A '-2026':14A,17A '1':109C '1.0.4':77C 'access':157C 'adjac':66B,155C 'affect':167C 'applic':100C,128C,147C 'array':54B,59B,122C 'attack':64B,153C 'block':7A,51B,86C,114C,133C 'build':158C 'check':80C 'come':141C 'communic':49B,96C 'connect':44B,89C 'control':22B,42B 'corrupt':65B 'cr':108C,163C 'cve':13A,16A 'data':72B,140C 'default':111C 'devic':12A,37B 'disabl':164C 'embed':19B 'end':60B,119C 'establish':146C 'follow':136C 'hold':55B 'industri':21B,41B 'industrial-control':20B 'let':61B 'max':106C 'mc':107C,162C 'mcr':84C 'memori':9A,67B 'multicast':5A,48B,95C 'nearbi':63B 'need':150C 'net':3A,25B,30B,75C 'network':156C 'number':82C,93C 'one':137C 'open':34B 'open-sourc':33B 'option':161C 'overflow':8A 'p':2A,24B,29B,74C 'p-net':1A,23B,28B,73C 'packag':26B 'past':57B,117C 'pnet':105C,160C 'profinet':11A,27B,36B 'relat':50B,97C 'relationship':101C,129C,148C 'request':6A,45B,70B,85C,90C,144C 'request-suppli':69B 'requir':154C 'rest':125C 'room':103C 'sourc':35B 'stack':38B 'suppli':71B 'uncheck':4A 'use':39B 'write':56B 'written':116C,139C","nicknames":[],"mitigations":[],"who_affected":"Only devices built on P-Net before 1.0.4 with the multicast communication relation option enabled are exposed. The attacker must be on the same local network segment, and no established Application Relationship is needed. Builds with PNET_OPTION_MC_CR disabled can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","industrialcontrol","package","pnet","profinet"],"campaign_type":null,"search_a":"'-127122':15A,18A '-2026':14A,17A 'block':7A 'cve':13A,16A 'devic':12A 'memori':9A 'multicast':5A 'net':3A 'overflow':8A 'p':2A 'p-net':1A 'profinet':11A 'request':6A 'uncheck':4A","search_b":"'adjac':66B 'array':54B,59B 'attack':64B 'block':51B 'communic':49B 'connect':44B 'control':22B,42B 'corrupt':65B 'data':72B 'devic':37B 'embed':19B 'end':60B 'hold':55B 'industri':21B,41B 'industrial-control':20B 'let':61B 'memori':67B 'multicast':48B 'nearbi':63B 'net':25B,30B 'open':34B 'open-sourc':33B 'p':24B,29B 'p-net':23B,28B 'packag':26B 'past':57B 'profinet':27B,36B 'relat':50B 'request':45B,70B 'request-suppli':69B 'sourc':35B 'stack':38B 'suppli':71B 'use':39B 'write':56B","search_c":"'1':109C '1.0.4':77C 'access':157C 'adjac':155C 'affect':167C 'applic':100C,128C,147C 'array':122C 'attack':153C 'block':86C,114C,133C 'build':158C 'check':80C 'come':141C 'communic':96C 'connect':89C 'cr':108C,163C 'data':140C 'default':111C 'disabl':164C 'end':119C 'establish':146C 'follow':136C 'max':106C 'mc':107C,162C 'mcr':84C 'multicast':95C 'need':150C 'net':75C 'network':156C 'number':82C,93C 'one':137C 'option':161C 'p':74C 'p-net':73C 'past':117C 'pnet':105C,160C 'relat':97C 'relationship':101C,129C,148C 'request':85C,90C,144C 'requir':154C 'rest':125C 'room':103C 'written':116C,139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127122","severity":null,"published_at":"2026-11-13T14:17:54+00:00","modified_at":"2026-11-13T14:17:54+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}