CVE-2026-110021mediumCWE-347

CVE-2026-110021: fallo de gravedad media en Phoenix Contact PLCnext Engineer

Missing GSDX SignatureValue verification

Publicada el

Seguir esta CVE+ Monitorear PLCnext Engineer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.1%
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
Phoenix Contact · PLCnext Engineer
CVEs relacionadas — Phoenix Contact PLCnext Engineer

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-110935HIGHPath traversal in plug-in deploymentEPSS 0.2%CVE-2026-110022HIGHSigned plug-in validation bypassEPSS 0.1%