CVE-2025-32398
📋 TL;DR
A NULL pointer dereference vulnerability in RT-Labs P-Net library versions 1.0.1 and earlier allows remote attackers to crash industrial control system devices by sending specially crafted RPC packets. This affects any IO devices using the vulnerable P-Net library for industrial network communications.
💻 Affected Systems
- RT-Labs P-Net library
- Industrial IO devices using P-Net protocol
📦 What is this software?
P Net by Rt Labs
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service in critical industrial control systems, potentially disrupting manufacturing processes, safety systems, or infrastructure operations.
Likely Case
Targeted IO device crashes requiring manual restart, causing temporary production interruptions in industrial environments.
If Mitigated
Isolated device failures with minimal operational impact due to redundancy and proper network segmentation.
🎯 Exploit Status
Exploitation requires network access to P-Net enabled devices but no authentication. The vulnerability is in protocol parsing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with device vendors for updated firmware
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-32398
Restart Required: Yes
Instructions:
1. Contact device vendors for patched firmware. 2. Schedule maintenance window. 3. Backup configurations. 4. Apply firmware updates. 5. Verify functionality post-update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate P-Net devices in separate VLANs with strict firewall rules
Traffic Filtering
allBlock unnecessary RPC traffic at network boundaries
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable devices
- Deploy intrusion detection systems monitoring for abnormal P-Net traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware versions against vendor advisories. Use network scanners to identify P-Net protocol usage.Check Version:
Vendor-specific commands vary. Typically check via device web interface or vendor management tools.Verify Fix Applied:
Verify firmware version is updated beyond vulnerable versions. Test device stability with normal RPC traffic.📡 Detection & Monitoring
Log Indicators:
- Device crash/restart logs
- Abnormal P-Net protocol errors
- Unexpected device reboots
Network Indicators:
- Malformed RPC packets to port 20000/udp (typical P-Net)
- Unusual traffic patterns to industrial devices
SIEM Query:
source="industrial_devices" AND (event_type="crash" OR event_type="reboot") AND protocol="P-Net"