CVE-2025-32405: Rt-labs P-net DOS Vulnerability

CVE-2025-32405 Overview

CVE-2025-32405 is an out-of-bounds write vulnerability [CWE-787] in the RT-Labs P-Net library, an open-source PROFINET device stack used by industrial IO devices. Versions 1.0.1 and earlier are affected. An unauthenticated remote attacker can send a malicious Remote Procedure Call (RPC) packet to crash IO devices that rely on the library. The flaw impacts availability of operational technology (OT) endpoints communicating over PROFINET, a protocol widely deployed in industrial control systems (ICS).

Critical Impact

A single crafted RPC packet can crash PROFINET IO devices, disrupting industrial processes that depend on the RT-Labs P-Net stack.

Affected Products

• RT-Labs P-Net version 1.0.1 and earlier
• Industrial IO devices integrating the P-Net PROFINET device stack
• ICS/OT environments using PROFINET communication based on P-Net

Discovery Timeline

• 2025-05-07 - CVE-2025-32405 published to NVD
• 2025-05-13 - Last updated in NVD database

Technical Details for CVE-2025-32405

Vulnerability Analysis

The vulnerability resides in the RPC packet processing logic of the RT-Labs P-Net PROFINET device stack. P-Net implements the PROFINET protocol used by programmable logic controllers (PLCs) and IO devices for real-time field communication. The library parses incoming RPC requests as part of the connection establishment and parameterization workflow.

A crafted RPC packet triggers a write beyond the bounds of an allocated buffer. The out-of-bounds write corrupts adjacent memory regions and induces a crash in the device process consuming the library. Because PROFINET nodes typically run with minimal recovery logic, the crash halts industrial communication until the device is restarted.

The attack is network-based, requires no authentication, and requires no user interaction. Confidentiality and integrity are not directly impacted, but availability loss in an ICS context can disrupt physical processes. Refer to the Nozomi Networks Vulnerability Advisory for additional technical details.

Root Cause

The root cause is missing or insufficient bounds checking when copying attacker-controlled fields from an incoming RPC packet into a fixed-size internal buffer. The parser trusts length or offset values supplied in the packet, allowing a write past the buffer boundary.

Attack Vector

An attacker with network reachability to a PROFINET IO device sends a single malformed RPC packet to the device's PROFINET service port. Because PROFINET is typically deployed on flat OT networks, any host on the same Layer 2 segment can reach vulnerable devices and trigger the crash.

No verified exploit code is publicly available for CVE-2025-32405. See the linked advisory for protocol-level details.

Detection Methods for CVE-2025-32405

Indicators of Compromise

• Unexpected restarts, watchdog resets, or communication loss on PROFINET IO devices running RT-Labs P-Net
• Malformed or oversized PROFINET DCE/RPC packets observed on UDP port 34964 or related PROFINET traffic
• Repeated session establishment failures from a single source toward multiple IO devices

Detection Strategies

• Deploy ICS-aware network monitoring to inspect PROFINET DCE/RPC traffic for protocol anomalies and oversized fields
• Baseline normal PROFINET RPC communication patterns and alert on deviations such as unsolicited RPC requests from non-controller hosts
• Correlate device crash events from engineering workstations or PLC diagnostics with concurrent suspicious PROFINET traffic

Monitoring Recommendations

• Monitor OT network segments for new or unexpected sources of PROFINET traffic
• Enable logging on managed industrial switches to capture port-level traffic statistics and link state changes during incidents
• Track firmware and software inventory to identify devices running RT-Labs P-Net 1.0.1 or earlier

How to Mitigate CVE-2025-32405

Immediate Actions Required

• Identify all IO devices and products embedding RT-Labs P-Net version 1.0.1 or earlier
• Restrict PROFINET network access to authorized controllers using VLAN segmentation and firewall rules
• Apply vendor firmware updates that incorporate a patched version of P-Net as soon as they become available

Patch Information

RT-Labs has addressed the issue in P-Net releases beyond version 1.0.1. Device manufacturers integrating P-Net must rebuild firmware against the fixed version and distribute updates to operators. Consult the Nozomi Networks Vulnerability Advisory for upstream fix references.

Workarounds

• Isolate PROFINET traffic on dedicated OT VLANs with strict access control lists
• Block PROFINET DCE/RPC traffic at boundary firewalls between IT and OT networks
• Disable PROFINET services on devices where the protocol is not operationally required

# Example: restrict PROFINET DCE/RPC traffic to a trusted controller subnet
iptables -A FORWARD -p udp --dport 34964 -s 10.10.20.0/24 -d 10.10.30.0/24 -j ACCEPT
iptables -A FORWARD -p udp --dport 34964 -j DROP