A vulnerability in the ADS discovery mechanism of Apache PLC4X's Go implementation (PLC4Go) and Java implementation (PLC4J) allows an attacker who can send UDP datagrams to the discovering host to redirect connections to arbitrary addresses. The issue arises because the connection address is derived from the claimed AmsNetId in the response body rather than the actual source address of the datagram. This can lead to an attacker inserting malicious inventory entries and intercepting ADS sessions with route credentials. Additionally, malformed datagrams can disrupt discovery listeners, causing them to stop or consume excessive CPU resources. The vulnerability affects versions prior to 1.0.0 and is fixed in version 1.0.0, which correctly derives connection addresses from the datagram source and logs warnings on mismatches.