VDE-2021-043

1. Use general security best practices to protect systems from local and network attacks. 2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication 3. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. 4. If it is not possible to disable the network server, using a host-based firewall to restrict access to the CmLAN port can reduce the risk. 5. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed. 6. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. 7. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port. For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://wibu.com/support/security-advisories.html

1. Use general security best practices to protect systems from local and network attacks. 2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication 3. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. 4. If it is not possible to disable the network server, using a host-based firewall to restrict access to the CmLAN port can reduce the risk. 5. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed. 6. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. 7. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port. For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://wibu.com/support/security-advisories.html

We strongly encourage e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. During the WIBU-SYSTEMS Codemeter installation process, refer to the recommended setup settings according to the WIBU-SYSTEMS advisories, a brief summary is provided in the chapter mitigation. Please check for updates and details that may not be included in this document. WAGO will provide updated e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) setup routines with the latest WIBU-SYSTEMS Codemeter version in Q4/2021.

We strongly encourage e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. During the WIBU-SYSTEMS Codemeter installation process, refer to the recommended setup settings according to the WIBU-SYSTEMS advisories, a brief summary is provided in the chapter mitigation. Please check for updates and details that may not be included in this document. WAGO will provide updated e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) setup routines with the latest WIBU-SYSTEMS Codemeter version in Q4/2021.