CVE-2021-20094
mediumPriorität · verfolgen · 32EPSS 0.047 · 92. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenDesigo CC family V5.0siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanagersiemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenPSS(R)CAPEsiemens_psirt
CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- Behobenwago_psirt
We strongly encourage e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. During the WIBU-SYSTEMS Codemeter installation process, refer to the recommended setup settings according to the WIBU-SYSTEMS advisories, a brief summary is provided in the chapter mitigation. Please check for updates and details that may not be included in this document. WAGO will provide updated e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) setup routines with the latest WIBU-SYSTEMS Codemeter version in Q4/2021.
- Behobenendress_hauser_psirt
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- BehobenPSS(R)CAPEcisa_csaf_ot
CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- BehobenDesigo CC family V5.0cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanagercisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- MitigationPSS(R)CAPEsiemens_psirt
If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.
- MitigationSICAM 230siemens_psirt
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
- Mitigationwago_psirt
1. Use general security best practices to protect systems from local and network attacks. 2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication 3. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. 4. If it is not possible to disable the network server, using a host-based firewall to restrict access to the CmLAN port can reduce the risk. 5. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed. 6. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. 7. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port. For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://wibu.com/support/security-advisories.html
- Mitigationendress_hauser_psirt
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- MitigationPSS(R)CAPEcisa_csaf_ot
If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.
- MitigationSICAM 230cisa_csaf_ot
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
- Kein Fix geplantSICAM 230siemens_psirt
Currently no remediation is planned
- Kein Fix geplantSICAM 230cisa_csaf_ot
Currently no remediation is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (47)
Betroffene Produkte und Versionsbereiche.
- Siemens PSS(R)CAPE≤ CAPE_14_installations_installed_from_material_dated_earlier_than_2021-06-16cisa_csaf_otUS
Advisories (6)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-625850SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager2023-11-14csaf · siemens_psirtDE
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
- SSA-675303SSA-675303: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products2021-07-13csaf · siemens_psirtDE
WIBU Systems published information about two vulnerabilities and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2021-20093 and CVE-2021-20094. Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- VDE-2021-043WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro2021-08-31csaf · wago_psirtDE
Multiple vulnerabilities were reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installation bundles with Version 2.3.9.46, 2.3.9.47, 2.3.9.49, 2.3.9.53, 2.3.9.55, 2.3.9.61 and 2.3.9.66 contain vulnerable versions of WIBU-SYSTEMS Codemeter.
- VDE-2022-019Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components2022-06-02csaf · endress_hauser_psirtDE
For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.
- ICSA-21-210-02Wibu-Systems CodeMeter Runtime2021-07-13icsa · cisa_csaf_otUS
WIBU Systems published information about two vulnerabilities and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2021-20093 and CVE-2021-20094. Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- ICSA-23-320-03Siemens Desigo CC product family2023-11-14icsa · cisa_csaf_otUS
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-02.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02cnnvd
- https://vigilance.fr/vulnerability/WIBU-Systems-CodeMeter-denial-of-service-via-HTTP-35869cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2575cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021073002cnnvd
- https://www.tenable.com/security/research/tra-2021-24cnnvd
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-02.pdfenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan