CVE-2026-110021: Missing GSDX SignatureValue verification
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML SignatureValue over canonicalized SignedInfo. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty SignatureValue. PLCnext Engineer prior to 2026.6 reports the package as Valid and selects the modified device description for import under the default policy.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of PLCnext Engineer versions prior to 2026.6 are exposed when importing a modified signed GSDML package. Exploitation requires local access, but no authentication or user interaction is required.
Are default settings affected?
Yes. Under the default policy, PLCnext Engineer reports the modified package as Valid and selects the altered device description for import.
What must an attacker do to exploit the flaw?
The attacker must modify signed GSDML content, update the corresponding manifest digest, retain the public certificate data, and leave an invalid but nonempty SignatureValue. The application verifies the manifest reference digest but does not cryptographically validate SignatureValue over canonicalized SignedInfo.
How can I tell whether a package may have bypassed signature verification?
A package shown as Valid may still contain an invalid nonempty SignatureValue if it was processed by an affected version. The provided information does not describe an indicator or detection method beyond this verification gap.