{"id":"CVE-2026-127124","kind":"vulnerability","aliases":["CVE-2026-127124"],"related":[],"title":"P-Net: RPC sessions leak, letting attackers stop devices answering connections","description":"P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the response. Repeated fragments or requests with different activity UUIDs exhaust the available sessions, one UDP packet per session. Once they are exhausted the device no longer answers a Connect request until it is restarted. An unauthenticated attacker with ADJACENT network access can use this to cause a denial of service.","summary":"P-Net is an industrial Ethernet protocol stack used in embedded devices. Before version 1.0.4, RPC sessions for incomplete or unanswered requests are never released, so an attacker on the local network can exhaust them with crafted UDP packets and make the device stop answering Connect requests until restarted.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"P-Net","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded","industrial-ethernet","p-net","profinet","runtime"],"not_affected_if":["not-on-adjacent-network","p-net-1.0.4-or-later"],"how_to_check":"- Check whether the device or firmware embeds P-Net, and which version: `unknown` if the sources do not say how to read it\n- Confirm the P-Net version in the device's build or firmware metadata is below `1.0.4`","fix":"- P-Net: upgrade to `1.0.4` or later","status":"open","published_at":"2026-11-13T14:17:54+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:19+00:00","updated_at":"2026-11-13T15:21:19+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T15:21:19Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: upgrade to `1.0.4` or later","reach":"network","title":"P-Net: RPC sessions leak, letting attackers stop devices answering connections","impact":"low","summary":"P-Net is an industrial Ethernet protocol stack used in embedded devices. Before version 1.0.4, RPC sessions for incomplete or unanswered requests are never released, so an attacker on the local network can exhaust them with crafted UDP packets and make the device stop answering Connect requests until restarted.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["p-net","industrial-ethernet","embedded","profinet"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"device stops answering Connect requests until restarted","analyst_note":"Confirm which products and firmware bundle P-Net and where the vendor advisory with the fix lives; the NVD entry gives no product ranges.","how_to_check":"- Check whether the device or firmware embeds P-Net, and which version: `unknown` if the sources do not say how to read it\n- Confirm the P-Net version in the device's build or firmware metadata is below `1.0.4`","plain_action":"","product_name":"P-Net","needs_analyst":true,"not_affected_if":["p-net-1.0.4-or-later","not-on-adjacent-network"],"who_is_affected":"Devices that embed P-Net before 1.0.4 and accept RPC Connect requests over UDP on the local network are exposed. Systems that do not run P-Net, or that are not reachable from adjacent networks, can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4635,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127124':15A,18A '-2026':14A,17A '1.0.4':46B,85C 'access':169C 'activ':102C,136C 'adjac':167C 'alloc':92C 'also':125C 'answer':11A,76B,155C 'applic':122C 'arriv':114C 'attack':8A,59B,165C 'avail':140C 'caus':174C 'connect':12A,77B,157C 'craft':68B 'cve':13A,16A 'denial':176C 'devic':10A,43B,74B,152C 'differ':135C 'embed':22B,42B 'ethernet':25B,37B 'exhaust':65B,138C,150C 'fragment':95C,131C 'get':120C 'incomplet':50B 'industri':24B,36B 'industrial-ethernet':23B 'keep':86C 'kept':126C 'leak':6A 'let':7A 'local':62B 'longer':154C 'make':72B 'net':3A,21A,28B,33B,83C 'network':63B,168C 'never':55B,113C 'one':142C 'p':2A,20A,27B,32B,82C 'p-net':1A,19A,26B,31B,81C 'packet':70B,144C 'per':145C 'profinet':29B 'protocol':38B 'relationship':123C 'releas':56B 'repeat':130C 'request':53B,78B,98C,112C,133C,158C 'respons':129C 'rest':109C 'restart':80B,162C 'rpc':4A,47B,88C 'runtim':30B 'servic':178C 'session':5A,48B,89C,116C,141C,146C 'stack':39B 'stop':9A,75B 'timeout':106C 'udp':69B,143C 'unansw':52B 'unauthent':164C 'unknown':101C 'use':40B,171C 'uuid':103C,137C 'version':45B 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Devices that embed P-Net before 1.0.4 and accept RPC Connect requests over UDP on the local network are exposed. Systems that do not run P-Net, or that are not reachable from adjacent networks, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pnet"],"ptokens":["net"],"labels":["embedded","high","industrialethernet","pnet","profinet","runtime","vendor"],"campaign_type":null,"search_a":"'-127124':15A,18A '-2026':14A,17A 'answer':11A 'attack':8A 'connect':12A 'cve':13A,16A 'devic':10A 'leak':6A 'let':7A 'net':3A,21A 'p':2A,20A 'p-net':1A,19A 'rpc':4A 'session':5A 'stop':9A","search_b":"'1.0.4':46B 'answer':76B 'attack':59B 'connect':77B 'craft':68B 'devic':43B,74B 'embed':22B,42B 'ethernet':25B,37B 'exhaust':65B 'incomplet':50B 'industri':24B,36B 'industrial-ethernet':23B 'local':62B 'make':72B 'net':28B,33B 'network':63B 'never':55B 'p':27B,32B 'p-net':26B,31B 'packet':70B 'profinet':29B 'protocol':38B 'releas':56B 'request':53B,78B 'restart':80B 'rpc':47B 'runtim':30B 'session':48B 'stack':39B 'stop':75B 'udp':69B 'unansw':52B 'use':40B 'version':45B","search_c":"'1.0.4':85C 'access':169C 'activ':102C,136C 'adjac':167C 'alloc':92C 'also':125C 'answer':155C 'applic':122C 'arriv':114C 'attack':165C 'avail':140C 'caus':174C 'connect':157C 'denial':176C 'devic':152C 'differ':135C 'exhaust':138C,150C 'fragment':95C,131C 'get':120C 'keep':86C 'kept':126C 'longer':154C 'net':83C 'network':168C 'never':113C 'one':142C 'p':82C 'p-net':81C 'packet':144C 'per':145C 'relationship':123C 'repeat':130C 'request':98C,112C,133C,158C 'respons':129C 'rest':109C 'restart':162C 'rpc':88C 'servic':178C 'session':89C,116C,141C,146C 'timeout':106C 'udp':143C 'unauthent':164C 'unknown':101C 'use':171C 'uuid':103C,137C 'without':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127124","severity":null,"published_at":"2026-11-13T14:17:54+00:00","modified_at":"2026-11-13T14:17:54+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}