Improper verification of the source of communication in the ADS discovery process of Apache PLC4X's Go and Java implementations allows attackers able to send UDP datagrams to redirect connections to attacker-chosen hosts. The discovery result's connection address was taken from the AmsNetId in the response body instead of the datagram's actual source address, enabling spoofed responses to insert arbitrary inventory entries. This can cause applications to open ADS sessions, including route credentials, to malicious hosts. Additionally, malformed datagrams can disable discovery listeners or cause high CPU usage. The vulnerability affects PLC4Go versions from 0.11.0 before 1.0.0, PLC4J ADS and Modbus drivers from 0.10.0 before 1.0.0, and PLC4J EtherNet/IP driver from 0.11.0 before 1.0.0. Version 1.0.0 fixes the issue by deriving connection addresses from the datagram source and logging warnings on discrepancies.

An attacker able to send UDP datagrams to a host running the vulnerable PLC4X discovery can redirect connections to arbitrary hosts, potentially exposing ADS sessions and route credentials to attackers. This could lead to unauthorized access or interception of communications. Additionally, malformed datagrams can disrupt discovery functionality by causing listener crashes or excessive CPU usage, impacting availability of discovery services.

Users should upgrade to Apache PLC4X version 1.0.0 or later, which fixes the vulnerability by deriving connection addresses from the datagram's actual source address and logging warnings when discrepancies occur. This upgrade also addresses denial-of-service conditions caused by malformed datagrams. No other mitigation is required as the fix is official and available.