Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | PLCnext Engineer | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-121/ |
|
Wed, 04 Nov 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy. | |
| Title | Missing GSDX SignatureValue verification | |
| First Time appeared |
Phoenix Contact
Phoenix Contact plcnext Engineer |
|
| Weaknesses | CWE-347 | |
| CPEs | cpe:2.3:a:phoenix_contact:plcnext_engineer:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Phoenix Contact
Phoenix Contact plcnext Engineer |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: CERTVDE
Published:
Updated: 2026-11-04T09:19:31.248Z
Reserved: 2026-10-13T15:06:02.374Z
Link: CVE-2026-110021
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-347
Improper Verification of Cryptographic Signature