{"id":"CVE-2026-127125","kind":"vulnerability","aliases":["CVE-2026-127125"],"related":[],"title":"P-Net: RPC session crash lets adjacent attacker take industrial device offline","description":"P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.","summary":"P-Net is an industrial Profinet device stack; before 1.0.4, a resent unacknowledged response fragment makes it dereference a NULL pointer. An attacker on the same network segment who has seen an established Application Relationship UUID can crash the device.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"P-Net","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded","industrial-control","p-net","package","profinet"],"not_affected_if":["no-adjacent-network-access","p-net-1.0.4-or-later"],"how_to_check":"- Check the P-Net version in the device firmware or build, for example `P-Net` version string in the project.","fix":"- P-Net: `1.0.4` (fixed version stated in the description)","status":"open","published_at":"2026-11-13T14:17:55+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:28+00:00","updated_at":"2026-11-13T15:21:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:21:28Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: `1.0.4` (fixed version stated in the description)","reach":"network","title":"P-Net: RPC session crash lets adjacent attacker take industrial device offline","impact":"medium","summary":"P-Net is an industrial Profinet device stack; before 1.0.4, a resent unacknowledged response fragment makes it dereference a NULL pointer. An attacker on the same network segment who has seen an established Application Relationship UUID can crash the device.","audience":"businesses","category":"package","nicknames":[],"who_cares":["profinet","industrial-control","embedded","p-net"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"device crashes and stops responding on the network","analyst_note":"Confirm the P-Net version ranges and the vendor's advisory for how to check and upgrade affected devices; the sources give only the NVD description.","how_to_check":"- Check the P-Net version in the device firmware or build, for example `P-Net` version string in the project.\n- unknown","plain_action":"","product_name":"P-Net","needs_analyst":true,"not_affected_if":["p-net-1.0.4-or-later","no-adjacent-network-access"],"who_is_affected":"Devices built on P-Net before 1.0.4 that accept RPC sessions, such as Profinet industrial controllers and I/O devices. The attacker must be on the adjacent network and must have observed the AR UUID of an established Application Relationship. A conformant IO-controller does not send the triggering requests, so exposure depends on who can reach the device's segment.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4645,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127125':16A,19A '-2026':15A,18A '1.0.4':42B,77C 'abort':78C 'access':177C 'acknowledg':97C,140C 'activ':119C 'adjac':8A,175C 'anoth':118C 'applic':66B,80C,105C,112C,171C 'ar':166C 'attack':9A,55B,161C 'check':99C 'conform':151C 'connect':122C 'control':26B,154C 'crash':6A,70B,149C 'cve':14A,17A 'derefer':50B 'dereferenc':145C 'devic':12A,39B,72B,148C 'embed':23B 'establish':65B,170C 'exist':111C 'fragment':47B,88C,126C 'get':124C 'handl':129C 'industri':11A,25B,37B 'industrial-control':24B 'io':153C 'io-control':152C 'let':7A 'make':48B 'must':162C 'net':3A,22A,29B,34B,75C 'network':59B,176C 'null':52B,142C 'observ':164C 'offlin':13A 'one':134C 'p':2A,21A,28B,33B,74C 'p-net':1A,20A,27B,32B,73C 'packag':30B 'pointer':53B,143C 'profinet':31B,38B 'relationship':67B,81C,106C,113C,172C 'request':108C,159C 'requir':174C 'resent':44B,94C 'respons':46B,91C,127C,137C 'rpc':4A,84C 'seen':63B 'segment':60B 'send':157C 'sent':116C 'session':5A,85C,102C,132C 'stack':40B 'take':10A 'unacknowledg':45B 'uuid':68B,167C 'without':95C,98C,133C","nicknames":[],"mitigations":[],"who_affected":"Devices built on P-Net before 1.0.4 that accept RPC sessions, such as Profinet industrial controllers and I/O devices. The attacker must be on the adjacent network and must have observed the AR UUID of an established Application Relationship. A conformant IO-controller does not send the triggering requests, so exposure depends on who can reach the device's segment.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pnet"],"ptokens":["net"],"labels":["embedded","industrialcontrol","medium","package","pnet","profinet","vendor"],"campaign_type":null,"search_a":"'-127125':16A,19A '-2026':15A,18A 'adjac':8A 'attack':9A 'crash':6A 'cve':14A,17A 'devic':12A 'industri':11A 'let':7A 'net':3A,22A 'offlin':13A 'p':2A,21A 'p-net':1A,20A 'rpc':4A 'session':5A 'take':10A","search_b":"'1.0.4':42B 'applic':66B 'attack':55B 'control':26B 'crash':70B 'derefer':50B 'devic':39B,72B 'embed':23B 'establish':65B 'fragment':47B 'industri':25B,37B 'industrial-control':24B 'make':48B 'net':29B,34B 'network':59B 'null':52B 'p':28B,33B 'p-net':27B,32B 'packag':30B 'pointer':53B 'profinet':31B,38B 'relationship':67B 'resent':44B 'respons':46B 'seen':63B 'segment':60B 'stack':40B 'unacknowledg':45B 'uuid':68B","search_c":"'1.0.4':77C 'abort':78C 'access':177C 'acknowledg':97C,140C 'activ':119C 'adjac':175C 'anoth':118C 'applic':80C,105C,112C,171C 'ar':166C 'attack':161C 'check':99C 'conform':151C 'connect':122C 'control':154C 'crash':149C 'dereferenc':145C 'devic':148C 'establish':170C 'exist':111C 'fragment':88C,126C 'get':124C 'handl':129C 'io':153C 'io-control':152C 'must':162C 'net':75C 'network':176C 'null':142C 'observ':164C 'one':134C 'p':74C 'p-net':73C 'pointer':143C 'relationship':81C,106C,113C,172C 'request':108C,159C 'requir':174C 'resent':94C 'respons':91C,127C,137C 'rpc':84C 'send':157C 'sent':116C 'session':85C,102C,132C 'uuid':167C 'without':95C,98C,133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127125","severity":null,"published_at":"2026-11-13T14:17:55+00:00","modified_at":"2026-11-13T14:17:55+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}