Pilz: Multiple products prone to WIBU-SYSTEMS CodeMeter vulnerabilities
A number of Pilz software tools use the Software CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to change and falsify a licence file, prevent normal operation of Code- Meter (Denial-of-Service) and potentially execute arbitrary code.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-16233US | high7.5 | — | ||
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap. | ||||
| CVE-2020-14519US | high7.5 | — | ||
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected We… | ||||
| CVE-2020-14517US | critical9.8OT elevated | — | ||
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and… | ||||
| CVE-2020-14515US | high7.5 | — | ||
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows… | ||||
| CVE-2020-14513US | high7.5 | — | ||
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields. | ||||
| CVE-2020-12499US | high7.3 | — | ||
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files. | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- Fixed
Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.
- Fixed
Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.
- Fixed
Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.
- Fixed
Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.
- Fixed
Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.
- Fixed
Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan