---
id: "CVE-2026-127124"
page: "https://infrastack.ai/live/CVE-2026-127124"
kind: "vulnerability"
aliases: ["CVE-2026-127124"]
title: "P-Net: RPC sessions leak, letting attackers stop devices answering connections"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "P-Net", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["embedded", "industrial-ethernet", "p-net", "profinet", "runtime"]
not_affected_if: ["not-on-adjacent-network", "p-net-1.0.4-or-later"]
published_at: "2026-11-13T14:17:54+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127124", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# P-Net: RPC sessions leak, letting attackers stop devices answering connections

Link for people: https://infrastack.ai/live/CVE-2026-127124 (this .md is for agents)

P-Net is an industrial Ethernet protocol stack used in embedded devices. Before version 1.0.4, RPC sessions for incomplete or unanswered requests are never released, so an attacker on the local network can exhaust them with crafted UDP packets and make the device stop answering Connect requests until restarted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:P-Net affected range not listed fixed no fixed version listed

## How to check

- Check whether the device or firmware embeds P-Net, and which version: `unknown` if the sources do not say how to read it
- Confirm the P-Net version in the device's build or firmware metadata is below `1.0.4`

## Fix

- P-Net: upgrade to `1.0.4` or later

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127124

## From the sources

P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the response. Repeated fragments or requests with different activity UUIDs exhaust the available sessions, one UDP packet per session. Once they are exhausted the device no longer answers a Connect request until it is restarted. An unauthenticated attacker with ADJACENT network access can use this to cause a denial of service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_