PLCnext Engineer versions prior to 2026.6 do not cryptographically verify the XML SignatureValue over the canonicalized SignedInfo in GSDX manifest files. This allows an unauthenticated local attacker to modify signed GSDML content, update its manifest digest, and retain the public certificate data while leaving an invalid nonempty SignatureValue. Despite the invalid signature, the software reports the package as valid and imports the modified device description under the default policy.