Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components
For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-41057US | high7.1 | — | ||
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. | ||||
| CVE-2021-41184US | medium6.1 | Exploit | ||
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execut… | ||||
| CVE-2021-41183US | medium6.1 | — | ||
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may… | ||||
| CVE-2021-41182US | medium6.1 | Exploit | ||
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may e… | ||||
| CVE-2021-20094US | high7.5 | — | ||
A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server… | ||||
| CVE-2021-20093US | critical9.1 | — | ||
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or cr… | ||||
| CVE-2021-22901US | high8.1 | — | ||
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malic… | ||||
| CVE-2020-8286US | high7.5 | — | ||
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. | ||||
references
External citations — patches, advisories, analysis.
- VDE-2022-019: Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components - HTMLself
- CERT@VDE Security Advisories for Endress+Hauser AGexternal
- VDE-2022-019: Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components - CSAFself
- Vendor PSIRTexternal
remediations (16)
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- Fixed
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan