---
id: "CVE-2026-110021"
kind: "vulnerability"
aliases: ["CVE-2026-110021"]
title: "PLCnext Engineer: GSDX device file signature check can be bypassed locally"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["gsdml", "industrial-control", "plcnext", "plcnext-engineer", "vendor"]
not_affected_if: ["no-local-untrusted-files", "not-plcnext-engineer"]
published_at: "2026-11-04T10:17:24+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110021", "first_seen_at": "2026-11-04T10:26:34+00:00"}]
---

# PLCnext Engineer: GSDX device file signature check can be bypassed locally

PLCnext Engineer checks the digests of GSDX manifest references but never cryptographically verifies the XML signature value. A local attacker can alter a device description file, update its digest, and have the tool report it as valid and import it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PLCnext Engineer version (Help or About screen); unknown if the sources give a command.
- Review whether GSDML device description files are imported from shared or untrusted locations.

## Fix

- PLCnext Engineer: `2026.6` or later, per the sources.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110021

## From the sources

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_