P-NET · CVE-2026-127125 · Package
NO FIX YET · SEE WHAT TO DO
P-Net is an industrial Profinet device stack; before 1.0.4, a resent unacknowledged response fragment makes it dereference a NULL pointer. An attacker on the same network segment who has seen an established Application Relationship UUID can crash the device.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Devices built on P-Net before 1.0.4 that accept RPC sessions, such as Profinet industrial controllers and I/O devices. The attacker must be on the adjacent network and must have observed the AR UUID of an established Application Relationship. A conformant IO-controller does not send the triggering requests, so exposure depends on who can reach the device's segment.
Not affected if no-adjacent-network-access, p-net-1.0.4-or-later
Who cares embedded, industrial-control, p-net, profinet
P-Net version string in the project.1.0.4 (fixed version stated in the description)P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.