Description
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.
Published: 2026-11-04
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 09:30:00 +0000

Type Values Removed Values Added
Description The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.
Title Signed plug-in validation bypass
First Time appeared Phoenix Contact
Phoenix Contact plcnext Engineer
Weaknesses CWE-494
CPEs cpe:2.3:a:phoenix_contact:plcnext_engineer:*:*:*:*:*:*:*:*
Vendors & Products Phoenix Contact
Phoenix Contact plcnext Engineer
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Phoenix Contact Plcnext Engineer
cve-icon MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published:

Updated: 2026-11-04T09:19:51.762Z

Reserved: 2026-10-13T15:06:03.670Z

Link: CVE-2026-110022

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T10:17:24.473

Modified: 2026-11-04T10:17:24.473

Link: CVE-2026-110022

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T10:30:10Z

Weaknesses
  • CWE-494

    Download of Code Without Integrity Check