PHOENIX CONTACT: Products utilizing WIBU-SYSTEMS CodeMeter components
Several vulnerabilities have been discovered in WIBU-SYSTEMS CodeMeter and published 08 September 2020. Phoenix Contact is only affected by a subset of these vulnerabilities. Phoenix Contact products are not affected by vulnerabilities WIBU-200521-01 (CVE-2020- 14513), WIBU-200521-04 (CVE-2020-14517, and WIBU-200521-06 (CVE-2020-14515). For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-16233US | high7.5 | — | ||
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap. | ||||
| CVE-2020-14519US | high7.5 | — | ||
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected We… | ||||
| CVE-2020-14509US | critical9.8 | — | ||
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send s… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- Mitigation
Use general security best practices to protect systems from local and network attacks like described in the application note AH EN INDUSTRIAL SECURITY. Disable the CodeMeter Runtime WebSockets API. Run CodeMeter only as client and use localhost as binding for the CodeMeter communication. If you need to operate CodeMeter Runtime as Network License Server please make sure that it is operated in a secure environment. For detailed information please refer to WIBU Systems original Advisories.
- Mitigation
Use general security best practices to protect systems from local and network attacks like described in the application note AH EN INDUSTRIAL SECURITY. Disable the CodeMeter Runtime WebSockets API. Run CodeMeter only as client and use localhost as binding for the CodeMeter communication. If you need to operate CodeMeter Runtime as Network License Server please make sure that it is operated in a secure environment. For detailed information please refer to WIBU Systems original Advisories.
- Mitigation
Use general security best practices to protect systems from local and network attacks like described in the application note AH EN INDUSTRIAL SECURITY. Disable the CodeMeter Runtime WebSockets API. Run CodeMeter only as client and use localhost as binding for the CodeMeter communication. If you need to operate CodeMeter Runtime as Network License Server please make sure that it is operated in a secure environment. For detailed information please refer to WIBU Systems original Advisories.
- Fixed
WIBU-SYSTEMS has released a new CodeMeter Runtime version 7.10 to fix the known vulnerabilities and may continue to release further updated versions in the future. Phoenix Contact has released a new version of Activation Wizard 1.3.2, used for activation and deactivation of licenses, installing CodeMeter Runtime 7.10 on Windows PCs. After installation of Activation Wizard 1.3.2 all installed products using CodeMeter Runtime will use the latest CodeMeter Runtime 7.10 version. Activation Wizard 1.3.2 contains the official fix of WIBU-SYSTEMS for the known variabilities and is disabling the WebSockets API like recommended by WIBU-SYSTEMS. We strongly recommend downloading and installing Activation Wizard 1.3.2 or higher as the CVSS Score of the vulnerabilities are critical and high. Activation Wizard is available via the download areas of PLCnext Engineer, FL Network Manager, or EV Charging Suite. Since there can only be one installation of CodeMeter Runtime on a system, installing the latest version of CodeMeter Runtime as being included in Activation Wizard will fix the vulnerabilities for all other applications using CodeMeter Runtime as well. Please check your products web site for further updates regularly or register to Phoenix Contact PSIRT information's to receive latest updates about security advisories. Phoenix Contact recommends following security best practices to protect systems from local and network attacks as described in the application note AH EN INDUSTRIAL SECURITY.
- Fixed
WIBU-SYSTEMS has released a new CodeMeter Runtime version 7.10 to fix the known vulnerabilities and may continue to release further updated versions in the future. Phoenix Contact has released a new version of Activation Wizard 1.3.2, used for activation and deactivation of licenses, installing CodeMeter Runtime 7.10 on Windows PCs. After installation of Activation Wizard 1.3.2 all installed products using CodeMeter Runtime will use the latest CodeMeter Runtime 7.10 version. Activation Wizard 1.3.2 contains the official fix of WIBU-SYSTEMS for the known variabilities and is disabling the WebSockets API like recommended by WIBU-SYSTEMS. We strongly recommend downloading and installing Activation Wizard 1.3.2 or higher as the CVSS Score of the vulnerabilities are critical and high. Activation Wizard is available via the download areas of PLCnext Engineer, FL Network Manager, or EV Charging Suite. Since there can only be one installation of CodeMeter Runtime on a system, installing the latest version of CodeMeter Runtime as being included in Activation Wizard will fix the vulnerabilities for all other applications using CodeMeter Runtime as well. Please check your products web site for further updates regularly or register to Phoenix Contact PSIRT information's to receive latest updates about security advisories. Phoenix Contact recommends following security best practices to protect systems from local and network attacks as described in the application note AH EN INDUSTRIAL SECURITY.
- Fixed
WIBU-SYSTEMS has released a new CodeMeter Runtime version 7.10 to fix the known vulnerabilities and may continue to release further updated versions in the future. Phoenix Contact has released a new version of Activation Wizard 1.3.2, used for activation and deactivation of licenses, installing CodeMeter Runtime 7.10 on Windows PCs. After installation of Activation Wizard 1.3.2 all installed products using CodeMeter Runtime will use the latest CodeMeter Runtime 7.10 version. Activation Wizard 1.3.2 contains the official fix of WIBU-SYSTEMS for the known variabilities and is disabling the WebSockets API like recommended by WIBU-SYSTEMS. We strongly recommend downloading and installing Activation Wizard 1.3.2 or higher as the CVSS Score of the vulnerabilities are critical and high. Activation Wizard is available via the download areas of PLCnext Engineer, FL Network Manager, or EV Charging Suite. Since there can only be one installation of CodeMeter Runtime on a system, installing the latest version of CodeMeter Runtime as being included in Activation Wizard will fix the vulnerabilities for all other applications using CodeMeter Runtime as well. Please check your products web site for further updates regularly or register to Phoenix Contact PSIRT information's to receive latest updates about security advisories. Phoenix Contact recommends following security best practices to protect systems from local and network attacks as described in the application note AH EN INDUSTRIAL SECURITY.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan