Apache PLC4X EUVD-2026-89680

Exploitation requires the consuming application to explicitly invoke the opt-in ADS discovery API (PLC4Go 0.11.0-<1.0.0, or PLC4J ADS/Modbus 0.10.0-<1.0.0 and EtherNet/IP 0.11.0-<1.0.0), and for the credential-redirect impact, to subsequently act on the discovered inventory items by connecting to them. The attacker must be able to send UDP datagrams reaching the discovering host (adjacent/same-segment reachability, AV:A). No authentication is needed to send the spoofed or malformed datagram. The denial-of-service variants (PLC4Go listener panic on a short version block; PLC4J unhandled exceptions; PLC4J Modbus infinite CPU spin on a partial response) only require reaching the discovery listener, but still depend on discovery being invoked. Limiting factors: discovery is not enabled by default, the application must trust and connect to discovered devices, and network positioning is required.

This is a real but conditionally-gated OT/ICS-library vulnerability, not a headline drive-by. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N, base 8.5) is internally consistent with the description: an adjacent attacker who can send UDP datagrams to the discovering host needs no authentication, but success depends on the application both invoking the opt-in discovery API and then acting on the returned inventory (UI:P). The high VC/VI reflect that discovered-device connections - including configured ADS route credentials - can be redirected to an attacker-chosen host. Exploitation signals are weak: no EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so the correct status is that there is no public exploit identified at time of analysis. The reporter is the Apache Software Foundation itself (coordinated disclosure with a fixed 1.0.0 release), which raises confidence in the technical accuracy but does not indicate in-the-wild use. The one caveat worth flagging: the primary attack is described as redirecting connections to hosts 'outside the local network,' yet the vector is AV:A (adjacent) - the adjacency applies to the initial UDP injection reachability, not the redirect destination, so defenders should treat network-segment access to the discovering host as the true prerequisite. Overall this is a medium-priority issue: genuine credential-exposure impact, but heavily conditioned on non-default, opt-in discovery usage in a niche industrial library.

An operator runs a PLC4Go/PLC4X-based application that calls the ADS discovery API to enumerate nearby PLCs. An attacker with access to the same network segment sends a single spoofed UDP discovery response whose body claims an AmsNetId resolving to an attacker-controlled host; the discovery result is built from that claimed address rather than the datagram's real source. When the application later connects to the discovered 'device,' it opens an ADS session - including any configured route credentials - to the attacker's host. No public exploit code is identified at this time, though the flaw is straightforward to weaponize given a crafted UDP datagram.