CVE-2026-110021 · Vendor
NO FIX YET · SEE WHAT TO DO
PLCnext Engineer checks the digests of GSDX manifest references but never cryptographically verifies the XML signature value. A local attacker can alter a device description file, update its digest, and have the tool report it as valid and import it.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Engineering workstations running PLCnext Engineer prior to 2026.6 that import GSDML/GSDX device description files under the default policy. The attack requires local access to the file, so systems that only import vendor-verified device files from controlled sources face less risk. Teams that never use PLCnext Engineer can skip it.
Not affected if no-local-untrusted-files, not-plcnext-engineer
Who cares gsdml, industrial-control, plcnext, plcnext-engineer
2026.6 or later, per the sources.PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML SignatureValue over canonicalized SignedInfo. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty SignatureValue. PLCnext Engineer prior to 2026.6 reports the package as Valid and selects the modified device description for import under the default policy.
This page as .md · .json · in your agent: get_signal("CVE-2026-110021") · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.