CVE-2026-110021
Received Received - Intake

PLCnext Engineer Signature Validation Bypass via GSDML Tampering

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: CERT VDE

Description
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-110021
EUVD
EUVD-2026-116802

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Phoenix Contact PLCnext Engineer 0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Phoenix Contact's PLCnext Engineer software before version 2026.6. It fails to properly verify cryptographic signatures in GSDX files, which are PROFINET device descriptions. The software checks manifest digests but does not validate the XML SignatureValue over the canonicalized SignedInfo section. An attacker can modify signed GSDML content, update the manifest digest, and leave an invalid but nonempty SignatureValue. PLCnext Engineer then incorrectly marks the tampered package as valid and allows import.

Impact Analysis

An unauthenticated local attacker could exploit this to deploy manipulated module definitions or configurations without detection. This could lead to unauthorized changes in industrial control systems, potentially causing operational disruptions or safety hazards. The default policy in PLCnext Engineer may accept these modified files, increasing the risk of undetected tampering.

Mitigation Strategies

Update PLCnext Engineer to version 2026.6 or later to address the improper signature verification issue. Verify all GSDX files for integrity before importing and disable default import policies that accept unsigned or tampered files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...