ICS-Advisories

Risk Evaluation

This advisory addresses security issues in PLCnext firmware versions prior to 2026.0.3 that are related to APP handling and the processing of configuration files. The identified vulnerabilities affect APP installation authenticity as well as the handling of configuration data in writable directories. Successful exploitation may allow authenticated attackers with different privilege levels to compromise integrity, availability, and system security of affected PLCnext Control. Both issues are resolved starting with PLCnext firmware version 2026.0.3.

Zusammenfassung der Gegenmaßnahmen

For firmware versions prior to 2026.0.3 apps are installed via WBM (APP Manager) without enforced authenticity validation. Verify the SHA-256 checksum provided by the PLCnext Store manually before installing an APP. Restrict WBM access to trusted IP ranges via the firewall and protect Engineer credentials. Monitor APP lifecycle security notifications locally or via a central Syslog server. If APPs are not required, disable the APP Manager service via the WBM System Services page to eliminate an unnecessary attack vector. Starting with firmware version 2026.0.3, APP signature verification is enabled by default and only signed apps can be installed.