RT-Labs P-Net: NULL pointer dereference on implicit read of AR record
Summary
P-Net, RT-Labs' embedded Profinet IO device library, dereferences a NULL AR pointer when it handles an implicit read request without a valid target AR UUID for an AR-specific record index or for the expected identification data of a slot or subslot. A remote, unauthenticated attacker who can reach a vulnerable device on the network can send such a request and crash it, causing a denial of service. Only availability is affected, but industrial devices that embed the library may stop until they are restarted.
Affected
- RT-Labs P-Net before 1.0.3 (versions 0 to below 1.0.3)
- Devices and firmware that embed a vulnerable P-Net version: Unknown, ask the device manufacturer
Fixed in
- P-Net 1.0.3 or later
- Fixed firmware of embedding devices: Unknown, ask the device manufacturer
Workaround
Unknown. No configuration-based workaround is confirmed in the available sources.
Exploitation
- No public proof of concept known
- Not listed in CISA KEV; no evidence of exploitation in the wild found
- EPSS 0.4 % (percentile 34)
Our recommendation
- Inventory all Profinet devices and identify embedded P-Net versions with each manufacturer
- Ask device vendors for a patch timeline and confirm whether P-Net 1.0.3 or later is used
- Restrict Profinet and Layer 2 reachability to the PLC/controller segment and keep OT networks away from the internet and office LANs
- Monitor the RT-Labs advisory and NVD for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RT-Labs advisory RRTL-261019-01 (PDF) rt-labs.com
- VulDB entry 428594 vuldb.com
- Strix CVE-2026-111733 www.strix.ai
- CVE-2026-111733 threat intelligence cve.threatint.com
- RT-Labs P-Net product page rt-labs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:38.
Original description (NVD)
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device (denial of service).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.