{"id":"CVE-2026-127123","kind":"vulnerability","aliases":["CVE-2026-127123"],"related":[],"title":"P-Net: mismatched RPC fragment endianness lets another host hijack a session","description":"P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.","summary":"P-Net, an open-source PROFINET device stack for industrial controllers, releases an RPC session's Application Relationship without the abort procedure when a request fragment uses a different endianness than the first fragment. A host on the adjacent network that has seen the connection's activity UUID can send one PDU and take over the connection in its place.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["industrial-control","p-net","package","profinet"],"not_affected_if":["internet-isolated","not-profinet"],"how_to_check":"- Check whether the P-Net version in use is earlier than `1.0.4`\n- Find the P-Net library in the firmware or build of the PROFINET device and read its version","fix":"- P-Net: `1.0.4`","status":"open","published_at":"2026-11-13T14:17:54+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:27+00:00","updated_at":"2026-11-13T15:21:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:21:27Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: `1.0.4`","reach":"network","title":"P-Net: mismatched RPC fragment endianness lets another host hijack a session","impact":"medium","summary":"P-Net, an open-source PROFINET device stack for industrial controllers, releases an RPC session's Application Relationship without the abort procedure when a request fragment uses a different endianness than the first fragment. A host on the adjacent network that has seen the connection's activity UUID can send one PDU and take over the connection in its place.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","industrial-control"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over an industrial device's PROFINET connection","analyst_note":"","how_to_check":"- Check whether the P-Net version in use is earlier than `1.0.4`\n- Find the P-Net library in the firmware or build of the PROFINET device and read its version\n- unknown for anything beyond this","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-profinet","internet-isolated"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000684,"input_tokens":4629,"output_tokens":442,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127123':16A,19A '-2026':15A,18A '1.0.4':94C 'abort':50B,105C 'access':166C 'activ':76B,171C 'adjac':68B,164C 'anoth':9A,114C,153C 'applic':46B,97C,126C,132C,145C 'call':124C 'clear':151C,180C 'connect':74B,86B,157C,175C 'control':22B,40B 'cve':14A,17A 'cyclic':137C 'data':115C,138C 'devic':36B 'differ':58B 'endian':7A,59B,117C 'everi':182C 'first':62B,120C 'fragment':6A,55B,63B,109C,121C 'gone':135C 'hijack':11A 'host':10A,65B,154C,162C 'industri':21B,39B 'industrial-control':20B 'left':148C 'let':8A 'mismatch':4A 'net':3A,25B,30B,92C 'network':69B,165C 'observ':169C 'one':80B,189C 'open':33B 'open-sourc':32B 'p':2A,24B,29B,91C 'p-net':1A,23B,28B,90C 'packag':26B 'pdu':81B,190C 'place':89B,160C 'procedur':51B,106C 'profinet':27B,35B 'referenc':149C 'relationship':47B,98C,133C,146C 'releas':41B,95C 'represent':116C 'request':54B,112C,184C 'resourc':142C 'rpc':5A,43B,101C,183C 'seen':72B 'send':79B 'sent':178C 'session':13A,44B,102C 'sourc':34B 'stack':37B 'stop':139C 'structur':152C 'take':83B 'told':129C 'use':56B 'uuid':77B,172C 'without':48B,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["industrialcontrol","medium","package","pnet","profinet"],"campaign_type":null,"search_a":"'-127123':16A,19A '-2026':15A,18A 'anoth':9A 'cve':14A,17A 'endian':7A 'fragment':6A 'hijack':11A 'host':10A 'let':8A 'mismatch':4A 'net':3A 'p':2A 'p-net':1A 'rpc':5A 'session':13A","search_b":"'abort':50B 'activ':76B 'adjac':68B 'applic':46B 'connect':74B,86B 'control':22B,40B 'devic':36B 'differ':58B 'endian':59B 'first':62B 'fragment':55B,63B 'host':65B 'industri':21B,39B 'industrial-control':20B 'net':25B,30B 'network':69B 'one':80B 'open':33B 'open-sourc':32B 'p':24B,29B 'p-net':23B,28B 'packag':26B 'pdu':81B 'place':89B 'procedur':51B 'profinet':27B,35B 'relationship':47B 'releas':41B 'request':54B 'rpc':43B 'seen':72B 'send':79B 'session':44B 'sourc':34B 'stack':37B 'take':83B 'use':56B 'uuid':77B 'without':48B","search_c":"'1.0.4':94C 'abort':105C 'access':166C 'activ':171C 'adjac':164C 'anoth':114C,153C 'applic':97C,126C,132C,145C 'call':124C 'clear':151C,180C 'connect':157C,175C 'cyclic':137C 'data':115C,138C 'endian':117C 'everi':182C 'first':120C 'fragment':109C,121C 'gone':135C 'host':154C,162C 'left':148C 'net':92C 'network':165C 'observ':169C 'one':189C 'p':91C 'p-net':90C 'pdu':190C 'place':160C 'procedur':106C 'referenc':149C 'relationship':98C,133C,146C 'releas':95C 'represent':116C 'request':112C,184C 'resourc':142C 'rpc':101C,183C 'sent':178C 'session':102C 'stop':139C 'structur':152C 'told':129C 'uuid':172C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127123","severity":null,"published_at":"2026-11-13T14:17:54+00:00","modified_at":"2026-11-13T14:17:54+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}