XML Signature Verification Flaw in PLCnext Engineer by Phoenix Contact
CVE-2026-110021

6.9MEDIUM

Key Information:

Vendor: Phoenix Contact
Status: Plcnext Engineer
Vendor: CVE Published:; 4 November 2026

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2026-110021?

A vulnerability in PLCnext Engineer allows an unauthenticated local attacker to manipulate signed GSDML content. Due to inadequate cryptographic verification of the XML SignatureValue over canonicalized SignedInfo, attackers can alter the manifest digest while retaining the public certificate data. This exploitation results in PLCnext Engineer incorrectly marking the modified device description as Valid, leading to potential unauthorized access and importation under the default security policy.

Affected Version(s)

PLCnext Engineer 0.0 < 2026.6

References

https://www.certvde.com/en/advisories/VDE-2026-121/

CVSS V4

Score:

6.9

Severity:

MEDIUM

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Local

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 4, 2026
Vulnerability Reserved
Oct 13, 2026

Credit

Ievgen Bondarenko

CVE-2026-110021 Data

JSON