CVE-2026-111734
Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.
| CWE | CWE-125 |
| Vendor | rt-labs |
| Product | p-net |
| Published | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for rt-labs p-net
Be the first to know when new unknown vulnerabilities affecting rt-labs p-net are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
RT-Labs / P-Net
0 < 1.0.3
References
Credits
router0mail