Summary
GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.
Impact
GSDX (Signature Verification Bypass):
This vulnerability can lead to tampered PROFINET device descriptions (GSDML) being imported and displayed as cryptographically valid because the signature value is never verified against the signer's public key. As a result, manipulated module definitions, parameter limits, or device configurations can propagate into engineering projects and be deployed to PROFINET IO controllers and field devices without any indication of tampering.
PFI (Plugin Deployment Signature Bypass):
This vulnerability can lead to arbitrary code execution in the context of the PLCnext Engineer user because unsigned archive entries outside the signed prefix are deployed and overwrite verified plugin assemblies while the package still passes signature verification.
PFI (Path Traversal in Plugin Deployment):
The plugin deployment routine does not validate path components when extracting archive entries. A crafted plugin package containing relative path segments can write files outside the plugin repository to arbitrary locations accessible with the current user's permissions.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 1046008 | PLCnext Engineer | vers:generic/>=0.0|<2026.6 |
Vulnerabilities
Expand / Collapse allThe PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML SignatureValue over canonicalized SignedInfo. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty SignatureValue. PLCnext Engineer prior to 2026.6 reports the package as Valid and selects the modified device description for import under the default policy.
Mitigation
Phoenix Contact recommends to install plugins only from trusted sources and verified engineering libraries. To mitigate the GSDX vulnerability we recommend to use external tools to verify the signature.
Remediation
Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.
Acknowledgments
Phoenix Contact GmbH & Co. KG thanks the following parties for their efforts:
- CERTVDE for coordination. (see https://certvde.com/en/ )
- Ievgen Bondarenko from for reporting.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 14.10.2026 11:00 | Initial revision. |