---
id: "CVE-2026-127123"
page: "https://infrastack.ai/live/CVE-2026-127123"
kind: "vulnerability"
aliases: ["CVE-2026-127123"]
title: "P-Net: mismatched RPC fragment endianness lets another host hijack a session"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["industrial-control", "p-net", "package", "profinet"]
not_affected_if: ["internet-isolated", "not-profinet"]
published_at: "2026-11-13T14:17:54+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127123", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# P-Net: mismatched RPC fragment endianness lets another host hijack a session

Link for people: https://infrastack.ai/live/CVE-2026-127123 (this .md is for agents)

P-Net, an open-source PROFINET device stack for industrial controllers, releases an RPC session's Application Relationship without the abort procedure when a request fragment uses a different endianness than the first fragment. A host on the adjacent network that has seen the connection's activity UUID can send one PDU and take over the connection in its place.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the P-Net version in use is earlier than `1.0.4`
- Find the P-Net library in the firmware or build of the PROFINET device and read its version

## Fix

- P-Net: `1.0.4`

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127123

## From the sources

P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_