Phoenix Contact: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities in PLCnext Engineer programming software

Impact
GSDX (Signature Verification Bypass):

This vulnerability can lead to tampered PROFINET device descriptions (GSDML) being imported and displayed as cryptographically valid because the signature value is never verified against the signer's public key. As a result, manipulated module definitions, parameter limits, or device configurations can propagate into engineering projects and be deployed to PROFINET IO controllers and field devices without any indication of tampering.

PFI (Plugin Deployment Signature Bypass):

This vulnerability can lead to arbitrary code execution in the context of the PLCnext Engineer user because unsigned archive entries outside the signed prefix are deployed and overwrite verified plugin assemblies while the package still passes signature verification.

PFI (Path Traversal in Plugin Deployment):

The plugin deployment routine does not validate path components when extracting archive entries. A crafted plugin package containing relative path segments can write files outside the plugin repository to arbitrary locations accessible with the current user's permissions.

Mitigation
Phoenix Contact recommends to install plugins only from trusted sources and verified engineering libraries. To mitigate the GSDX vulnerability we recommend to use external tools to verify the signature.

Remediation
Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.