CVE-2023-3935
criticalPriorität · verfolgen · 1EPSS 0.020 · 80. PerzentilDEEURUUSEPSS · bewertet 2026-10-23
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenfesto_psirt
Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.
https://www.wibu.com/support/user/user-software.html - BehobenFesto Automation Suitefesto_psirt
Update to version 2.8.0 and use with CODESYS version >= 3.5.19.30
- BehobenAppEnginesick_psirt
Update to a codemeter runtime version >=7.60c. * Linux x86: * Stop running SICK AppEngine * Uninstall Codemeter: sudo dpkg -r CodeMeter * Download Codemeter >= 7.60c * Install Codemeter: sudo dpkg -i ./codemeter_7.xx.xxxx.xxx_amd64.deb * Start SICK AppEngine * Windows: * Stop running SICK AppEngine * Uninstall Codemeter using Windows settings app * Download Codemeter >= 7.60c * Install CodeMeterRuntime.exe * Enter URL in browser: http://localhost:22352/configuration/server_access.html * Configuration > Server > Server Access * Check Network Server enabled * Start SICK AppEngine
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - BehobenCODE-LOCsick_psirt
Update to a version >= 2.4.1.
- BehobenFlowGatesick_psirt
Update to a codemeter runtime version >=7.60c.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - BehobenLiDAR-LOCsick_psirt
Update to a version >= 2.4.1.
- BehobenPSS(R)CAPE V14siemens_psirt
CAPE V14 installations installed from material dated 2023-08-23 or later are not affected, as they contain a fixed version of CodeMeter Runtime. For installations of CAPE V14 using material earlier than 2023-08-23: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- BehobenPSS(R)CAPE V15siemens_psirt
Update to V15.0.22 or later version
- BehobenPSS(R)E V34siemens_psirt
Update to V34.9.6 or later version
- BehobenPSS(R)E V35siemens_psirt
Update to V35.6.1 or later version
- BehobenPSS(R)ODMS V13.0siemens_psirt
Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- BehobenPSS(R)ODMS V13.1siemens_psirt
Update to V13.1.12.1 or later version
- BehobenSIMATIC WinCC OA V3.17siemens_psirt
Update to V3.17 P030 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.18siemens_psirt
Update to V3.18 P021 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.19siemens_psirt
Update to V3.19 P006 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMIT Simulation Platformsiemens_psirt
Update to V11.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954445/ - BehobenSINEC INSsiemens_psirt
Update to V1.0 SP2 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109825710/ - BehobenDesigo CC family V5.0siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V7siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanagersiemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- Behobenphoenix_contact_psirt
PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V7.60c, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V7.60c has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage. Install Phoenix Contact Activation Wizard from version 1.7 when available.Please check the Phoenix Contact e-Shop for your related Software product regularly.
- Behobentrumpf_psirt
Get the latest version of the TRUMPF License Expert software (>= V2.0.0) at trumpf.com/de_DE/produkte/software/software-lizenzierung and install it on all affected servers and workstations.
- Behobenweidmueller_psirt
For the affected **u-control web Controllers** and **IoT-Gateways**, please update the firmware to at least version **2.0.2**. The firmware update can be obtained from [www.weidmueller.com](https://www.weidmueller.com). For **u-create studio**, please update the **CodeMeter control center** software to at least version **7.60c**. The Codemeter control center is included in u-create studio and is installed on your computer in parallel. The Codemeter control center update can be obtained from the **WIBU-SYSTEMS** homepage. Look for **'CodeMeter User Runtime für Windows'** on the WIBU website. Find below appropriate patched firmware versions for all affected products: | Product Number | Product Name | Patched in Version | |----------------|---------------------------------------------------|---------------------| | 1334950000 | UC20-WL2000-AC (with u-OS) | 2.0.2 | | 1334990000 | UC20-WL2000-IOT (with u-OS) | 2.0.2 | | 2682620000 | IOT-GW30 (with u-OS) | 2.0.2 | | 2682630000 | IOT-GW30-4G-EU (with u-OS) | 2.0.2 | | 2660130000 | u-create studio with CodeMeter control center | 7.60c |
- Behobenpilz_psirt
PAS4000, PASvisu, PIT User Authentication Service, PNOZsigma Configurator, PMIv8: Installthe fixed version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. PASloto, Live Video Server, SafetyEYE Configurator, PMC programming tool: These productsare end-of-live, please follow the general countermeasures.
- Behobencodesys_psirt
Update the following products to version 3.5.19.30. • CODESYS Control RTE (SL) • CODESYS Control RTE (for Beckhoff CX) SL • CODESYS Control Win (SL) • CODESYS HMI (SL) • CODESYS Development System • CODESYS OPC DA Server SL Update the following products to version to 4.10.0.0. • CODESYS Control for Linux SL • CODESYS Control for Linux ARM SL For the legacy CODESYS V2 products, no new version is scheduled.
- Behobenwago_psirt
Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. (https://www.wibu.com/support/user/user-software.html).
- Behobenendress_hauser_psirt
Endress+Hauser has released updated firmware versions that address this vulnerability. Customers are strongly advised to upgrade to the latest fixed version. For assistance, please contact your local Endress+Hauser service center.
- BehobenPSS(R)CAPE V14cisa_csaf_ot
CAPE V14 installations installed from material dated 2023-08-23 or later are not affected, as they contain a fixed version of CodeMeter Runtime. For installations of CAPE V14 using material earlier than 2023-08-23: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- BehobenPSS(R)CAPE V15cisa_csaf_ot
Update to V15.0.22 or later version
- BehobenPSS(R)E V34cisa_csaf_ot
Update to V34.9.6 or later version
- BehobenPSS(R)E V35cisa_csaf_ot
Update to V35.6.1 or later version
- BehobenPSS(R)ODMS V13.0cisa_csaf_ot
Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- BehobenPSS(R)ODMS V13.1cisa_csaf_ot
Update to V13.1.12.1 or later version
- BehobenSIMATIC WinCC OA V3.17cisa_csaf_ot
Update to V3.17 P030 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.18cisa_csaf_ot
Update to V3.18 P021 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.19cisa_csaf_ot
Update to V3.19 P006 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMIT Simulation Platformcisa_csaf_ot
Update to V11.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954445/ - BehobenSINEC INScisa_csaf_ot
Update to V1.0 SP2 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109825710/ - BehobenDesigo CC family V5.0cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V7cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanagercisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenCIROS Studio / Educationcisa_csaf_ot
Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.
https://www.wibu.com/support/user/user-software.html - BehobenFesto Automation Suitecisa_csaf_ot
Planned Fix in Summer Release 2024
- BehobenFluidDrawcisa_csaf_ot
Update to the latest version.
- BehobenFluidSIMcisa_csaf_ot
Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.
https://www.wibu.com/support/user/user-software.html - BehobenMES-PCcisa_csaf_ot
Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.
https://www.wibu.com/support/user/user-software.html - MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- MitigationAppEnginesick_psirt
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationCODE-LOCsick_psirt
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationFlowGatesick_psirt
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationLiDAR-LOCsick_psirt
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationSIM2000ST-Esick_psirt
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationTDC-Esick_psirt
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationPSS(R)CAPE V14siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationPSS(R)CAPE V15siemens_psirt
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationPSS(R)E V34siemens_psirt
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationPSS(R)E V35siemens_psirt
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationPSS(R)ODMS V13.0siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationPSS(R)ODMS V13.1siemens_psirt
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationSIMATIC PCS neo V3siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC PCS neo V4.0siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC WinCC OA V3.17siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC WinCC OA V3.18siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC WinCC OA V3.19siemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMIT Simulation Platformsiemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSINEC INSsiemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSINEMA Remote Connectsiemens_psirt
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- Mitigationphoenix_contact_psirt
1. Use general security best practices to protect systems from local and network attacks like described in the application node AH EN INDUSTRIAL SECURITY. 2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. If it is not possible to disable the network server, using a host-based firewall to restrict access to the network for reducing the risk is strongly recommended. 3. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed. 4. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port.
- Mitigationtrumpf_psirt
Implement general security best practices like network segmentation, endpoint protection and system hardening. Restrict network access to the TRUMPF License Expert server component to required clients only by using firewalls or other suitable products.
- Mitigationweidmueller_psirt
u-create studio: Disabling the network server function within CodeMeter would mitigate the vulnerability. To disable this function please refer to the following steps: 1. Navigate to the CodeMeter WebAdmin Website 2. Select option Settings > Server > Server access 3. Choose option 'deactivate' in section 'network server' 4. Click 'Apply' button on the bottom of the website
- Mitigationcodesys_psirt
WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability. Until an update is available for the affected CODESYS products or if this is not to be installed, CODESYS GmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of WIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html). If neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).
- Mitigationwago_psirt
Use general security best practices to protect systems from local and network attacks. For further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisory WIBU-230704-01 at Website https://www.wibu.com/support/security-advisories.html.
- Mitigationendress_hauser_psirt
If possible, configure CodeMeter to run in client-only mode. If server mode is required, restrict access to authorized clients by implementing an access control list. For Proline Promag 800 OPC UA Connectivity, CodeMeter operates as a server only during license activation. Installation and license activation are managed by Endress+Hauser. If a customer performs manual license activation, it is strongly recommended to limit network access to necessary clients only by using firewalls or equivalent security measures.
- MitigationPSS(R)CAPE V14cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationPSS(R)CAPE V15cisa_csaf_ot
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationPSS(R)E V34cisa_csaf_ot
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationPSS(R)E V35cisa_csaf_ot
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationPSS(R)ODMS V13.0cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationPSS(R)ODMS V13.1cisa_csaf_ot
For affected versions: Install WIBU Systems CodeMeter Runtime V7.60c or later version manually to fix the issue: Download the package from https://www.wibu.com/support/user/user-software.html and follow the installation instructions from WIBU Systems.
- MitigationSIMATIC PCS neo V3cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC PCS neo V4.0cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC WinCC OA V3.17cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC WinCC OA V3.18cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMATIC WinCC OA V3.19cisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSIMIT Simulation Platformcisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSINEC INScisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationSINEMA Remote Connectcisa_csaf_ot
If CodeMeter Runtime is configured as server: Limit remote access to systems where the CodeMeter Runtime network server is running
- MitigationFactory Talk Activation Managercisa_csaf_ot
Rockwell Automation encourages users to implement their suggested security best practices to minimize risk of the vulnerability.
- MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- WorkaroundPSS(R)CAPE V14siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)CAPE V15siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)E V34siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)E V35siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)ODMS V13.0siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)ODMS V13.1siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC PCS neo V3siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC PCS neo V4.0siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC WinCC OA V3.17siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC WinCC OA V3.18siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC WinCC OA V3.19siemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMIT Simulation Platformsiemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSINEC INSsiemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSINEMA Remote Connectsiemens_psirt
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)CAPE V14cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)CAPE V15cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)E V34cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)E V35cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)ODMS V13.0cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundPSS(R)ODMS V13.1cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC PCS neo V3cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC PCS neo V4.0cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC WinCC OA V3.17cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC WinCC OA V3.18cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMATIC WinCC OA V3.19cisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSIMIT Simulation Platformcisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSINEC INScisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- WorkaroundSINEMA Remote Connectcisa_csaf_ot
If CodeMeter Runtime is configured as client only in the affected product: Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts
- Kein Fix geplantSIMATIC PCS neo V3siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC PCS neo V4.0siemens_psirt
Currently no fix is planned
- Kein Fix geplantSINEMA Remote Connectsiemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC PCS neo V3cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC PCS neo V4.0cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSINEMA Remote Connectcisa_csaf_ot
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (207)
Betroffene Produkte und Versionsbereiche.
- CODESYS Development System 3.5.21.20 external component of Festo Automation Suite 2.8.0.138alle Versionenfixedcisa_csaf_otUScpe:2.3:a:codesys:development_system:3.5.21.20*:*:*:*:*:*:*:*
- Festo Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0alle Versionencisa_csaf_otUScpe:2.3:a:codesys:development_system:3.0:*:*:*:*:*:*:*
- Festo Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10alle Versionencisa_csaf_otUScpe:2.3:a:codesys:development_system:3.5.16.10:*:*:*:*:*:*:*
Advisories (19)
Hersteller- und Ökosystem-Meldungen dazu.
- FSA-202305Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in several products2023-11-28csaf · festo_psirtDE
A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction. This could lead to remote code execution and escalation of privileges giving full admin access on the host system for an already authenticated user (logged in locally to the PC).
- FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.
- SCA-2023-0009Vulnerability in Wibu-Systems CodeMeter Runtime affects multiple SICK products2023-09-29csaf · sick_psirtDE
Wibu-Systems disclosed a security vulnerability in the CodeMeter Runtime. There is a heap buffer overflow vulnerability which can potentially lead to a remote code execution. Currently, no PoC is known to Wibu-Systems. To exploit the heap overflow, additional protection mechanisms need to be broken. Remote access is only possible if CodeMeter is configured as a server. If CodeMeter is not configured as a server, the adversary would need to log in to the machine where the CodeMeter Runtime is running or trick the user into sending a malicious request to CodeMeter.
- SSA-240541SSA-240541: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products2023-09-12csaf · siemens_psirtDE
WIBU Systems published information about a heap buffer overflow vulnerability and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products for license management. The vulnerability is described in the section 'Vulnerability Classification' below and got assigned the CVE ID CVE-2023-3935. Successful exploitation of this vulnerability could allow - an unauthenticated remote attacker to execute code on vulnerable products, where CodeMeter Runtime (i.e., CodeMeter.exe) is configured as a server, or - an authenticated local attacker to gain root/admin privileges on vulnerable products, where CodeMeter Runtime is configured as a client. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
- SSA-625850SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager2023-11-14csaf · siemens_psirtDE
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
- VDE-2023-030Phoenix Contact: Multiple products affected by WIBU Codemeter Vulnerability (Update A)2023-09-19csaf · phoenix_contact_psirtDE
A Vulnerability in WIBU-SYSTEMS CodeMeter Runtime affects multiple Phoenix Contact products. Phoenix Contact devices using CodeMeter embedded are not affected by this vulnerability. Update A, 2023-11-13 Removed CVE-2023-4701 because it was revoked.
- VDE-2023-031Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability2023-09-13csaf · trumpf_psirtDE
The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60b) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes this vulnerability is available.Machines with a running and correctly installed mGuard hardware firewall cannot be exploited by this vulnerability if used as intended (according to the manual). Update A, 2023-11-13 Removed CVE-2023-4701 because it was revoked.
- VDE-2023-032Weidmueller: WIBU Vulnerability in multiple Products2023-11-09csaf · weidmueller_psirtDE
Multiple Weidmueller products are affected by recent WIBU vulnerability.
- VDE-2023-033Pilz: WIBU Vulnerabilitiy in multiple Products2023-10-12csaf · pilz_psirtDE
Several Pilz products use the 3rd party component "CodeMeter Runtime" from WIBU-SYSTEM AG to manage software licenses. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. The vulnerability can be exploited locally or over the network. Update A, 2023-12-05 changed affected version of "Software PASvisu < 1.15.0" to "Software PASvisu < 1.14.1" removed CVE-2023-4701 because it was revoked.
- VDE-2023-035CODESYS: Multiple products affected by WIBU Codemeter vulnerability2023-12-05csaf · codesys_psirtDE
Several CODESYS setups contain and install vulnerable versions of the WIBU CodeMeter Runtime.
- VDE-2023-042Wago: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro (UPDATE B)2023-09-25csaf · wago_psirtDE
Critical vulnerability has been discovered in the utilized component PROFINET IO Device by Hilscher Gesellschaft für Systemautomation mbH. The impact of the vulnerability on the affected device is that it can no longer perform acyclic requests may drop all established cyclic connections may disappear completely from the network For more information see advisory by Hilscher: https://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+PROFINET+IO+Device Update 20.11.2024: Products have been added
- VDE-2025-105Endress+Hauser: Multiple products affected by Wibu-Systems CodeMeter Vulnerability2025-12-08csaf · endress_hauser_psirtDE
A vulnerability in Wibu-Systems CodeMeter (up to version 7.60b) affects multiple Endress+Hauser products. This flaw can lead to a heap buffer overflow, which may allow remote code execution under certain conditions.
- WID-SEC-W-2023-2311Wibu-Systems CodeMeter: Schwachstelle ermöglicht Codeausführung und PrivilegienerweiterungDeutsch2023-09-12csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann eine Schwachstelle in Wibu-Systems CodeMeter ausnutzen, um beliebigen Code auszuführen oder seine Privilegien zu erweitern.
- WID-SEC-W-2024-0943CODESYS: Mehrere SchwachstellenDeutsch2024-04-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuführen.
- ICSA-23-257-06Siemans WIBU Systems CodeMeter2023-09-12icsa · cisa_csaf_otUS
WIBU Systems published information about a heap buffer overflow vulnerability and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products for license management. The vulnerability is described in the section 'Vulnerability Classification' below and got assigned the CVE ID CVE-2023-3935. Successful exploitation of this vulnerability could allow - an unauthenticated remote attacker to execute code on vulnerable products, where CodeMeter Runtime (i.e., CodeMeter.exe) is configured as a server, or - an authenticated local attacker to gain root/admin privileges on vulnerable products, where CodeMeter Runtime is configured as a client. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
- ICSA-23-320-03Siemens Desigo CC product family2023-11-14icsa · cisa_csaf_otUS
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
- ICSA-24-004-01Rockwell Automation FactoryTalk Activation2024-01-04icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in a buffer overflow and allow the attacker to gain full access to the system.
- ICSA-25-182-02FESTO Automation Suite, FluidDraw, and Festo Didactic Products2023-11-28icsa · cisa_csaf_otUS
A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction. This could lead to remote code execution and escalation of privileges giving full admin access on the host system for an already authenticated user (logged in locally to the PC).
- ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (14)
Externe Belege — Patches, Meldungen, Analysen.
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdfcnnvd
- https://cert.vde.com/en/advisories/VDE-2023-030/cnnvd
- https://cert.vde.com/en/advisories/VDE-2023-031/cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-3935/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-3935cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-WinCC-buffer-overflow-via-CodeMeter-Runtime-42254cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.5257cnnvd
- https://www.auscert.org.au/bulletins/ESB-2024.0108cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan