Summary
This release contains bug fixes since version 1.0.3, related to the handling of connect and write requests, alarms, DCP and RPC. We recommend upgrading.
Two of the fixes only reduce the risk. A remaining risk is described in the cybersecurity advisory for the alarm frames (CVE-2026-124759) and the RPC reject, fault and cancel PDUs (CVE-2026-124762), as the specification has no authentication of the sender of these PDUs.
Please see the cybersecurity advisory at https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf for more information.
Issues fixed
| ID | Summary | Component | Severity |
|---|---|---|---|
| 2698 | (CVE-2026-127125): p-net NULL pointer dereference when an unacknowledged response fragment times out on a session without an AR | P-Net | normal |
| 2694 | (CVE-2026-127124): p-net RPC session pool can be exhausted by unauthenticated, unfinished fragments | P-Net | normal |
| 2693 | (CVE-2026-127123): p-net releases a session’s AR without pf_cmdev_cm_abort() on a fragment endianness mismatch | P-Net | normal |
| 2692 | (CVE-2026-127122): p-net Connect accepts more MCR_REQ blocks than PNET_MAX_MC_CR, out-of-bounds write in the AR | P-Net | normal |
| 2690 | p-net does not answer an RPC cancel with a cancel_ack, aborts the AR instead | P-Net | normal |
| 2686 | (CVE-2026-124762): p-net RPC requests are accepted from any source address for an existing session, a foreign REJECT, CANCEL or FAULT aborts the AR (partly fixed) | P-Net | normal |
| 2685 | (CVE-2026-124761): p-net DCP Set-IP refused during an active AR is still stored and saved to non-volatile memory | P-Net | normal |
| 2681 | (CVE-2026-124760): p-net alarm receiver stays in WCNF after a failed notification parse, discards later alarms | P-Net | normal |
| 2680 | (CVE-2026-124759): p-net RTA alarm frames are accepted from any source, any host can abort an AR or forge alarms (partly fixed) | P-Net | normal |
| 2679 | (CVE-2026-124758): p-net IODWrite record_data_length smaller than block header underflows, out-of-bounds read | P-Net | normal |
Conformance tests
| Test Tool | Version | Result |
|---|---|---|
| PROFINET Test Bundle | 2.46.0.205 | Pass [1] |
[1] Pass with hints in DHT - Scenario 1 (CLRPC) due to ETS limitations.