VDE-2026-121

Vulnerability from csaf_phoenixcontactgmbhcokg - Published: 2026-11-04 10:00 - Updated: 2026-11-04 10:00
Summary
Phoenix Contact: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities in PLCnext Engineer programming software
Severity
High
Notes
Summary: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.
Impact: GSDX (Signature Verification Bypass): This vulnerability can lead to tampered PROFINET device descriptions (GSDML) being imported and displayed as cryptographically valid because the signature value is never verified against the signer's public key. As a result, manipulated module definitions, parameter limits, or device configurations can propagate into engineering projects and be deployed to PROFINET IO controllers and field devices without any indication of tampering. PFI (Plugin Deployment Signature Bypass): This vulnerability can lead to arbitrary code execution in the context of the PLCnext Engineer user because unsigned archive entries outside the signed prefix are deployed and overwrite verified plugin assemblies while the package still passes signature verification. PFI (Path Traversal in Plugin Deployment): The plugin deployment routine does not validate path components when extracting archive entries. A crafted plugin package containing relative path segments can write files outside the plugin repository to arbitrary locations accessible with the current user's permissions.
Mitigation: Phoenix Contact recommends to install plugins only from trusted sources and verified engineering libraries. To mitigate the GSDX vulnerability we recommend to use external tools to verify the signature.
Remediation: Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.
CVE-2026-110021

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
PLCnext Engineer 2026.6
Phoenix Contact / PLCnext Engineer
 1046008 cpe:2.3:a:phoenix_contact:plcnext_engineer:2026.6:*:*:*:*:*:*:* 2026.6
Product Identifier Version Remediation
PLCnext Engineer <2026.6
Phoenix Contact / PLCnext Engineer
 1046008 cpe:2.3:a:phoenix_contact:plcnext_engineer:*:*:*:*:*:*:*:* vers:generic/>=0.0|<2026.6
Vendor Fix
CVE-2026-110022

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-494 - Download of Code Without Integrity Check
Affected products
Fixed 1 product, the same list as for CVE-2026-110021
Known affected 1 product, the same list as for CVE-2026-110021
CVE-2026-110935

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2026-110021
Known affected 1 product, the same list as for CVE-2026-110021
References
Acknowledgments
CERTVDE certvde.com/en/
Ievgen Bondarenko
Ievgen Bondarenko
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERTVDE",
        "summary": "coordination.",
        "urls": [
          "https://certvde.com/en/"
        ]
      },
      {
        "names": [
          "Ievgen Bondarenko"
        ],
        "summary": "reporting."
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "High"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "GSDX (Signature Verification Bypass):\n\nThis vulnerability can lead to tampered PROFINET device descriptions (GSDML) being imported and displayed as cryptographically valid because the signature value is never verified against the signer\u0027s public key. As a result, manipulated module definitions, parameter limits, or device configurations can propagate into engineering projects and be deployed to PROFINET IO controllers and field devices without any indication of tampering.\n\nPFI (Plugin Deployment Signature Bypass):\n\nThis vulnerability can lead to arbitrary code execution in the context of the PLCnext Engineer user because unsigned archive entries outside the signed prefix are deployed and overwrite verified plugin assemblies while the package still passes signature verification.\n\nPFI (Path Traversal in Plugin Deployment):\n\nThe plugin deployment routine does not validate path components when extracting archive entries. A crafted plugin package containing relative path segments can write files outside the plugin repository to arbitrary locations accessible with the current user\u0027s permissions.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Phoenix Contact recommends to install plugins only from trusted sources and verified engineering libraries. To mitigate the GSDX vulnerability we recommend to use external tools to verify the signature.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@phoenixcontact.com",
      "name": "Phoenix Contact GmbH \u0026 Co. KG",
      "namespace": "https://phoenixcontact.com/psirt"
    },
    "references": [
      {
        "category": "external",
        "summary": "pcsa-2026-00016",
        "url": "https://phoenixcontact.com/psirt"
      },
      {
        "category": "external",
        "summary": "Phoenix Contact advisory overview at CERT@VDE",
        "url": "https://certvde.com/de/advisories/vendor/phoenixcontact/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-121: Phoenix Contact: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities in PLCnext Engineer programming software - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-121"
      },
      {
        "category": "self",
        "summary": "VDE-2026-121: Phoenix Contact: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities in PLCnext Engineer programming software - CSAF",
        "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-121.json"
      },
      {
        "category": "external",
        "summary": "Phoenix Contact application note",
        "url": "https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
      }
    ],
    "title": "Phoenix Contact: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities in PLCnext Engineer programming software",
    "tracking": {
      "aliases": [
        "VDE-2026-121",
        "PCSA-2026-00016"
      ],
      "current_release_date": "2026-11-04T10:00:00.000Z",
      "generator": {
        "date": "2026-10-30T10:12:10.279Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-121",
      "initial_release_date": "2026-11-04T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-14T09:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:generic/\u003e=0.0|\u003c2026.6",
                "product": {
                  "name": "PLCnext Engineer \u003c2026.6",
                  "product_id": "CSAFPID-51001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:phoenix_contact:plcnext_engineer:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "1046008"
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "2026.6",
                "product": {
                  "name": "PLCnext Engineer 2026.6",
                  "product_id": "CSAFPID-52001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:phoenix_contact:plcnext_engineer:2026.6:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "1046008"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PLCnext Engineer"
          }
        ],
        "category": "vendor",
        "name": "Phoenix Contact"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ievgen Bondarenko"
          ],
          "summary": "reporting."
        }
      ],
      "cve": "CVE-2026-110021",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - 6.9 / Medium",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.",
          "product_ids": [
            "CSAFPID-51001"
          ],
          "restart_required": {
            "category": "system"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.2,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.2,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "Missing GSDX SignatureValue verification"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ievgen Bondarenko"
          ],
          "summary": "reporting."
        }
      ],
      "cve": "CVE-2026-110022",
      "cwe": {
        "id": "CWE-494",
        "name": "Download of Code Without Integrity Check"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.",
          "product_ids": [
            "CSAFPID-51001"
          ],
          "restart_required": {
            "category": "system"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "Signed plug-in validation bypass"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ievgen Bondarenko"
          ],
          "summary": "reporting."
        }
      ],
      "cve": "CVE-2026-110935",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as \u0027..\u0027 are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user\u0027s permissions which could result in full system compromise. ",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.",
          "product_ids": [
            "CSAFPID-51001"
          ],
          "restart_required": {
            "category": "system"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "Path traversal in plug-in deployment"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.