org.apache.plc4x/plc4j-driver-eip vulnerabilities

Latest org.apache.plc4x/plc4j-driver-eip CVEs

Newest publication first

1. CVE-2026-102511 Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

   Published 2026-09-30

   High·CVSS 8.5 EPSS 0.18%

   Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.