CVE-2026-111734High· 7.1▾ TwilightP-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame co…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.
P-Net < 1.0.3Upgrade to P-Net 1.0.3 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115795Medium· 5.3Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
CVE-2026-111735High· 7.1Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-115794Low· 2.3Alarm data length not validated against received frame length
CVE-2026-112200High· 8.7Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
CVE-2026-111736High· 8.7NULL pointer dereference on implicit read of user specific record index