CVE-2025-32402: Rt-labs P-net DOS Vulnerability

CVE-2025-32402 Overview

CVE-2025-32402 is an out-of-bounds write vulnerability [CWE-787] affecting RT-Labs P-Net version 1.0.1 and earlier. P-Net is an open-source PROFINET device stack used to implement industrial IO devices that communicate over Ethernet. An attacker can send a malicious Remote Procedure Call (RPC) packet to a vulnerable device and trigger a crash. The flaw is remotely reachable, requires no authentication, and impacts availability of affected industrial endpoints.

Critical Impact
A single malicious RPC packet can crash any IO device built on RT-Labs P-Net 1.0.1 or earlier, disrupting industrial control processes that depend on PROFINET communication.

Affected Products

RT-Labs P-Net version 1.0.1
RT-Labs P-Net versions earlier than 1.0.1
Industrial IO devices and embedded systems linking against the p-net PROFINET stack

Discovery Timeline

2025-05-07 - CVE-2025-32402 published to the National Vulnerability Database (NVD)
2025-05-13 - Last updated in NVD database

Technical Details for CVE-2025-32402

Vulnerability Analysis

The vulnerability resides in the RPC packet parsing logic of the RT-Labs P-Net PROFINET stack. PROFINET uses DCE/RPC over UDP for connection establishment and parameter exchange between controllers and IO devices. An attacker on the same network segment as a vulnerable device can craft an RPC packet whose fields drive the stack to write past the bounds of a target buffer.

The out-of-bounds write corrupts adjacent memory in the embedded device, leading to a crash of the PROFINET stack or the host process. Because IO devices are typically deployed on flat industrial networks, the attack does not require credentials or user interaction. Successful exploitation produces a denial-of-service condition that halts the affected device and any physical process it controls.

Root Cause

The defect is classified under [CWE-787] Out-of-bounds Write. The P-Net RPC parser fails to validate length or offset fields supplied in attacker-controlled RPC packets before writing decoded data into fixed-size internal structures. When the supplied values exceed the destination buffer, the stack writes beyond allocated memory.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted PROFINET DCE/RPC packet to UDP services exposed by the IO device. Because PROFINET devices commonly sit on routable OT networks alongside engineering workstations, any compromised host on the same broadcast domain can deliver the payload. See the Nozomi Networks Vulnerability Advisory for additional technical context.

No verified proof-of-concept code is publicly available.
Refer to the Nozomi Networks advisory for protocol-level details.

Detection Methods for CVE-2025-32402

Indicators of Compromise

Unexpected restarts, watchdog resets, or stack traces on PROFINET IO devices running p-net
Malformed DCE/RPC packets targeting UDP ports used by PROFINET on the OT segment
Repeated PROFINET connection establishment failures preceding device crashes

Detection Strategies

Deploy OT-aware network monitoring that parses PROFINET DCE/RPC traffic and alerts on oversized or malformed length fields
Correlate device offline events from SCADA/HMI systems with packet captures of inbound RPC traffic
Baseline normal PROFINET RPC sources and flag packets originating from unexpected hosts

Monitoring Recommendations

Log all PROFINET RPC sessions at OT network boundaries and forward to a centralized SIEM for retention
Monitor IO device health counters and availability metrics for crash-restart patterns
Alert on new MAC or IP addresses initiating PROFINET communications inside the cell network

How to Mitigate CVE-2025-32402

Immediate Actions Required

Inventory all IO devices and firmware images that embed RT-Labs p-net version 1.0.1 or earlier
Restrict PROFINET traffic to trusted controllers using VLAN segmentation and OT firewall rules
Isolate vulnerable IO devices from engineering, IT, and remote-access networks until patched

Patch Information

Upgrade RT-Labs P-Net to a version later than 1.0.1 that contains the bounds-checking fix. Device vendors that statically link p-net must rebuild and reissue firmware. Consult the Nozomi Networks Vulnerability Advisory and RT-Labs project releases for the fixed version reference.

Workarounds

Apply strict ingress filtering so only authorized PROFINET controllers can reach IO device RPC ports
Enable PROFINET Security Class features where supported by the device and controller
Use unidirectional gateways or data diodes between OT cells and higher-level networks to block crafted RPC packets

bash

# Example: restrict PROFINET DCE/RPC to a known controller using iptables on a Linux-based gateway
iptables -A FORWARD -p udp --dport 34964 -s 10.10.20.5 -d 10.10.20.0/24 -j ACCEPT
iptables -A FORWARD -p udp --dport 34964 -d 10.10.20.0/24 -j DROP