The PFI plugin framework deployed by PLCnext Engineer installs executable DLLs from a signed plugin package by extracting files into a local repository and loading them via reflection. The extraction routine verifies the signature only for a specific portion of the archive and never checks the rest of the entries. This oversight allows an unauthenticated local attacker to place an unsigned DLL at the same destination path as a legitimate signed assembly. When the archive is processed, the attacker’s DLL overwrites the signed file and is subsequently loaded without any additional integrity check, granting the attacker arbitrary code execution and complete control over the affected system. This vulnerability is classified as CWE‑494.

Phoenix Contact’s PLCnext Engineer platform is impacted. The provided CPE string covers all releases of the product, and no version ranges are specified, so the assumption is that every current iteration of PLCnext Engineer may be vulnerable unless a specific version is documented as safe.

The reported CVSS score is 8.6, indicating high severity. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, but its potential for full compromise makes it a significant risk. Exploitation requires local, unauthenticated write access to the plugin repository; the attacker need only to inject an unsigned DLL into an archive that the application will extract. Because the malicious code runs in the same process as the PLCnext application, a successful attack leads to total system takeover.