CVE-2026-110021
Missing GSDX SignatureValue verification
Description
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Phoenix Contact | PLCnext Engineer | 0.0 to <2026.6 |
References
External links from the record. They lead to third-party sites.