RT-Labs P-Net is a Profinet device stack used in embedded firmware of industrial devices such as PLCs, I/O modules, drives and sensors. Versions before 1.0.3 do not release RPC sessions allocated for requests naming an unknown interface or object UUID, and do not start a timeout for them. A remote, unauthenticated attacker can exhaust the available sessions with repeated requests, so the device stops answering new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted.
RT-Labs · P-Net
P-Net, a PROFINET IO stack for embedded industrial field devices, does not release the Application Relationship and RPC session when an RPC request with incorrect endianness is rejected. Repeated requests exhaust the available sessions, and the device stops answering new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker on the network can cause a denial of service, which can interrupt a production process.
RT-Labs · P-Net
P-Net before 1.0.3, a PROFINET device stack used in industrial I/O devices, dereferences a NULL AR pointer when it handles an implicit read request without a valid AR UUID for a user specific record index. This happens only if the application has registered a read callback. A remote unauthenticated attacker who can reach the device can send such a request and crash it, causing a denial of service. The CVSS 8.7 score is the CNA's; NVD analysis is still pending.
RT-Labs · P-Net
P-Net, RT-Labs' embedded Profinet IO device library, dereferences a NULL AR pointer when it handles an implicit read request without a valid target AR UUID for an AR-specific record index or for the expected identification data of a slot or subslot. A remote, unauthenticated attacker who can reach a vulnerable device on the network can send such a request and crash it, causing a denial of service. Only availability is affected, but industrial devices that embed the library may stop until they are restarted.
RT-Labs · P-Net
RT-Labs P-Net, a PROFINET device stack used in embedded industrial devices, contains an out-of-bounds write when parsing AR Vendor Block requests. Only builds with the compile option PNET_OPTION_AR_VENDOR_BLOCKS enabled are affected, and this option is disabled by default. A crafted Connect request sent over the network, without authentication or user interaction, can crash the device (denial of service) and potentially allow arbitrary code execution.
RT-Labs · P-Net
P-Net, RT-Labs' PROFINET device stack, enters an infinite loop when it handles a read request for the PDPortDataCheck record with subslot 0 (whole module). The port loop never advances, so the device stops responding. A remote, unauthenticated attacker with network access to the device can cause a denial of service that can halt the affected industrial device.
RT-Labs · P-Net
