CVE-2026-111734: Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pfethrecv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which deployments are affected?
P-Net versions before 1.0.3 are affected. Systems are exposed when they can receive Ethernet frames from an adjacent network attacker.
What does an attacker need to exploit this issue?
The attacker needs network-adjacent access to send crafted Ethernet frames. No privileges or user interaction are required.
What is the practical remediation?
Update P-Net to version 1.0.3 or later. The affected behavior is present in versions before 1.0.3.