RT-Labs P-Net: Resource exhaustion through unreleased RPC sessions
Summary
RT-Labs P-Net is a Profinet device stack used in embedded firmware of industrial devices such as PLCs, I/O modules, drives and sensors. Versions before 1.0.3 do not release RPC sessions allocated for requests naming an unknown interface or object UUID, and do not start a timeout for them. A remote, unauthenticated attacker can exhaust the available sessions with repeated requests, so the device stops answering new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted.
Affected
- RT-Labs P-Net versions before 1.0.3
- Devices with embedded P-Net: vendor firmware versions are unknown.
Fixed in
- Upgrade to P-Net 1.0.3 or later.
- Vendor firmware that includes the fix: Unknown.
Workaround
- Vendor workaround: Unknown.
- Restricting access to the device's Ethernet/RPC services reduces exposure, but no vendor-confirmed mitigation was found.
Exploitation
- Exploited in the wild: No information found.
- Public proof of concept: None found.
- CISA KEV listing: Not verified.
Our recommendation
- Inventory PROFINET/OT devices and ask manufacturers whether their firmware embeds P-Net, and which version.
- Request firmware with P-Net 1.0.3 or later and check the RT-Labs advisory for all fixes in the same release.
- Segment PROFINET traffic and block external access to these devices now.
- Monitor for unexpected loss of PROFINET connectivity, which may indicate an attack or a device that needs a restart.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RT-Labs security advisory RRTL-261019-01 rt-labs.com
- VulDB entry 428600 vuldb.com
- CVE record mirror (threatint) cve.threatint.com
- RT-Labs P-Net on GitHub github.com
- ST P-Net partner product page www.st.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:37.
Original description (NVD)
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.