PLCnext Engineer verifies the GSDX manifest reference digests but does not cryptographically verify the XML SignatureValue over canonicalized SignedInfo. An unauthenticated local attacker can alter signed GSDML files, adjust the manifest digest, keep the exported public certificate, and insert an invalid non‑empty SignatureValue. The software incorrectly reports such a package as Valid and imports the tampered device description under the default policy, allowing the attacker to modify PLC device configuration.

Phoenix Contact PLCnext Engineer. All editions and versions released before 2026.6 are vulnerable. The flaw resides in the GSDX signature verification logic that processes GSDML files.

The CVSS score of 6.9 indicates moderate severity. Because the exploit requires local, unauthenticated access and no other prerequisites are noted, the likelihood of exploitation is low to moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is a local compromise that provides file‑system access; once the device description is imported, the attacker can alter configuration, potentially leading to downtime or unsafe operation.