{"id":"CVE-2026-110022","kind":"vulnerability","aliases":["CVE-2026-110022"],"related":[],"title":"PLCnext Engineer before 2026.6: unsigned plugin archive entries overwrite signed assemblies and run code","description":"The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.","summary":"The PFI plugin framework extracts DLL files from a signed plugin package but skips signature checks on some archive entries. A local attacker can overwrite a legitimate signed assembly with malicious code that the plugin loader then runs.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PLCnext Engineer","fixed":["2026.6"],"affected":"< 2026.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["dotnet","ics","other","pfi","phoenix-contact","plcnext-engineer","plugin-framework","windows"],"not_affected_if":["pfi-not-installed","plcnext-engineer-2026.6-or-later"],"how_to_check":"Check the installed PLCnext Engineer version; any version below 2026.6 is affected. Also check where plugin packages come from: the vendor advises installing plugins only from trusted sources and verified engineering libraries.","fix":"Upgrade PLCnext Engineer to 2026.6 (Phoenix Contact)","status":"open","published_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:05+00:00","updated_at":"2026-11-04T10:30:46+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-04T10:27:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"PFI plugin framework: unsigned archive entries let local attacker run code","impact":"high","summary":"The PFI plugin framework extracts DLL files from a signed plugin package but skips signature checks on some archive entries. A local attacker can overwrite a legitimate signed assembly with malicious code that the plugin loader then runs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pfi","plugin-framework","dotnet","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker code runs with full control of the affected system","analyst_note":"Find the affected PFI versions, the fixed version and the vendor advisory; the NVD entry alone gives no product ranges or fix.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["pfi-not-installed"],"who_is_affected":"Systems running the PFI plugin framework that load plugins from a local plugin repository are exposed. The sources do not say which versions are affected or whether a default configuration is vulnerable. Teams not running PFI can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4204,"output_tokens":443,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected PFI versions, the fixed version and the vendor advisory; the NVD entry alone gives no product ranges or fix.","search":"'-110022':17A,20A '-2026':16A,19A '2026.6':4A 'addit':154C 'affect':164C 'archiv':7A,55B,103C,128C 'assembl':11A,65B,81C,136C 'attack':59B,116C,149C 'attacker-suppli':148C 'check':52B,156C 'code':14A,68B,151C 'compromis':161C 'contact':29B 'cover':108C 'cve':15A,18A 'deploy':79C,100C 'destin':140C 'dll':42B,121C 'dlls':82C 'dotnet':23B 'engin':2A,32B 'engineer':22A 'entri':8A,56B,104C 'execut':80C 'extract':41B 'file':43B 'framework':35B,40B,78C 'full':160C 'ic':24B 'instanti':146C 'integr':155C 'legitim':63B,134C 'load':94C 'loader':72B,144C 'local':58B,90C,115C 'malici':67B 'never':107C 'outsid':122C 'overwrit':9A,61B,132C 'packag':48B,87C 'pass':129C 'path':141C 'pfi':26B,38B,76C 'phoenix':28B 'phoenix-contact':27B 'plcnext':1A,21A,31B 'plcnext-engin':30B 'plugin':6A,34B,39B,47B,71B,77C,86C,91C,143C 'plugin-framework':33B 'prefix':125C 'process':102C 'reflect':97C 'replac':118C 'repositori':92C 'result':157C 'routin':101C 'run':13A,74B 'sign':10A,46B,64B,85C,124C,135C 'signatur':51B,111C 'skip':50B 'suppli':150C 'system':165C 'unauthent':114C 'unsign':5A,120C 'verif':112C,130C 'via':96C 'window':36B 'without':152C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Phoenix Contact PLCnext Engineer (model no. 1046008) older than 2026.6 is exposed. A local attacker who can supply a crafted plugin package can get code to run as the PLCnext Engineer user. Teams that do not use PLCnext Engineer, or already run 2026.6 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T10:30:46Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-121/","run_id":1662},"products":{"at":"2026-11-04T10:30:46Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-121/","run_id":1662},"who_affected":{"at":"2026-11-04T10:30:46Z","by":"analyst","doc":"https://certvde.com/en/advisories/VDE-2026-121/","run_id":1662}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["engineer","plcnextengineer"],"ptokens":["engineer","plcnext"],"labels":["dotnet","high","ics","other","pfi","phoenixcontact","plcnextengineer","pluginframework","windows"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110022","severity":null,"published_at":"2026-11-04T10:17:24+00:00","modified_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110022:1662","url":null,"severity":null,"published_at":"2026-11-04T10:30:46+00:00","modified_at":"2026-11-04T10:30:46+00:00","first_seen_at":"2026-11-04T10:30:46+00:00","fetched_at":"2026-11-04T10:30:46+00:00","note":"Phoenix Contact PLCnext Engineer < 2026.6, fixed in 2026.6, per CERT@VDE VDE-2026-121 (sibling CVEs 110935, 110021 same advisory). No exploitation or PoC found; no social search done (B tier)."}],"documents":[{"id":66167,"url":"https://certvde.com/en/advisories/VDE-2026-121/","title":"VDE-2026-121 Phoenix Contact PLCnext Engineer","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}