PLCnext Engineer signature check and plug-in deployment flaws
A fake device file can get into this factory controller tool and hack the PC.
Summary
PLCnext Engineer does not cryptographically verify the signature of GSDX device description files, so modified files are accepted as valid. Its plug-in deployment also skips checks on archive paths and signed content. Versions prior to 2026.6 are affected.
What to do
Update to version 2026.6 or later.
Products and platforms
CVE IDs
Sources
Times
First published
First seen