TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities
A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-16233US | high7.5 | — | ||
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap. | ||||
| CVE-2020-14519US | high7.5 | — | ||
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected We… | ||||
| CVE-2020-14517US | critical9.8OT elevated | — | ||
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and… | ||||
| CVE-2020-14515US | high7.5 | — | ||
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows… | ||||
| CVE-2020-14513US | high7.5 | — | ||
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields. | ||||
| CVE-2020-14509US | critical9.8 | — | ||
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send s… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- MitigationTRUMPF CAD/CAM software tools
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
- MitigationTRUMPF CAD/CAM software tools
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
- MitigationTRUMPF CAD/CAM software tools
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
- MitigationTRUMPF CAD/CAM software tools
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
- MitigationTRUMPF CAD/CAM software tools
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
- MitigationTRUMPF CAD/CAM software tools
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan