SSA-507364: Heap Based Buffer Overflow Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager
Versions V6.0 through V8 QU1 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could lead to code execution in the context of the current process. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-38545US | critical9.8 | Exploit | ||
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the ad… | ||||
references
External citations — patches, advisories, analysis.
- SSA-507364: Heap Based Buffer Overflow Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager - CSAF Versionself
- SSA-507364: Heap Based Buffer Overflow Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager - HTML Versionself
remediations (6)
- FixedDesigo CC family V6
Apply patch as documented in section 'Additional Information'
- FixedDesigo CC family V7
Apply patch as documented in section 'Additional Information'
- FixedDesigo CC family V8
Update to V8.0 QU2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997962/ - FixedSENTRON Powermanager V6
Apply patch as documented in section 'Additional Information'
- FixedSENTRON Powermanager V7
Apply patch as documented in section 'Additional Information'
- FixedSENTRON Powermanager V8
Update to V8.0 QU2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109771760/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan