Phoenix Contact Plcnext Engineer
6 CVEs affecting Phoenix Contact Plcnext Engineer. Latest disclosed: 2026-11-04. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46142 | High | 8.8 | 2023-12-14 | A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on… |
CVE-2026-110935 | High | 8.4 | 2026-11-04 | The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries c… |
CVE-2026-110022 | High | 8.4 | 2026-11-04 | The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but… |
CVE-2020-12499 | High | 8.2 | 2020-07-21 | In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files. |
CVE-2023-46144 | Medium | 6.5 | 2023-12-14 | A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affec… |
CVE-2026-110021 | Medium | 6.2 | 2026-11-04 | PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unau… |