CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

Apache PLC4X's ADS device discovery trusts the AmsNetId claimed inside a UDP discovery response instead of the datagram's actual source IP, so an attacker on the network who can send a single spoofed response can make the discovering application connect its next ADS session — including any configured route credentials — to an attacker-chosen host, even one outside the local network. The same discovery listeners are trivially deniable: a malformed datagram panics the PLC4Go ADS listener, crashes the PLC4J ADS and EtherNet/IP discoverers, or makes the PLC4J Modbus discoverer spin and consume a CPU core on a partial response. Exploitation requires the application to call the opt-in discovery API and, for the credential-redirect path, to act on the discovered entries, with an attacker able to reach the discovering host via UDP (CVSS 4.0: 8.5, adjacent network, user interaction required). Affected consumers are applications built on PLC4Go 0.11.0–0.9.x-era releases and PLC4J drivers before 1.0.0; upgrading to Apache PLC4X 1.0.0 fixes all variants by deriving the connection address from the datagram source and logging a warning on mismatch. No public proof of concept is known and the issue is not in the CISA KEV catalog.