https://seclists.org/oss-sec/2026/q3/1020: CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed sponses and derives the connection target from them

Q: What access does an attacker need to exploit this issue?

The attacker must be able to send UDP datagrams to the host performing ADS discovery. No attacker privileges are required, but user participation is required according to the CVSS vector.

Q: What is the practical impact if a discovered device is used?

A spoofed discovery response can create an inventory entry pointing to an attacker-chosen address, including an address outside the local network. If the application connects to that discovered device, it may establish an ADS session and send configured route credentials to the attacker-controlled host.

Q: Which releases are affected?

Apache PLC4X 0.10.0 and 0.11.0 releases before 1.0.0 are affected. Apache PLC4X 1.0.0 is listed as unaffected.

Published Sep 30, 2026

Updated

Affected Software

4 affected components

Apache PLC4Go>=0.11.0<1.0.0

Apache PLC4J ADS driver>=0.10.0<1.0.0

Apache PLC4J Modbus driver>=0.10.0<1.0.0

Apache PLC4J EtherNet/IP driver>=0.11.0<1.0.0

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be able to send UDP datagrams to the host performing ADS discovery. No attacker privileges are required, but user participation is required according to the CVSS vector.

What is the practical impact if a discovered device is used?

A spoofed discovery response can create an inventory entry pointing to an attacker-chosen address, including an address outside the local network. If the application connects to that discovered device, it may establish an ADS session and send configured route credentials to the attacker-controlled host.

Which releases are affected?

Apache PLC4X 0.10.0 and 0.11.0 releases before 1.0.0 are affected. Apache PLC4X 1.0.0 is listed as unaffected.

https://seclists.org/oss-sec/2026/q3/1020: CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed sponses and derives the connection target from them

Affected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the practical impact if a discovered device is used?

Which releases are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the practical impact if a discovered device is used?

Which releases are affected?