CVE-2025-47809

highPriorität · verfolgen · 0EPSS 0.002 · 7. PerzentilDEEUNLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.18% (7th) EPSS
CVSS 8.2 · high
Is it mine?
200 products
Prüfe deine Angriffsfläche
Who says so?
9 sources
cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSICK CODE-LOC with Firmware < LLS-2.8.1.24092Rsick_psirt

    On Microsoft Windows systems, it is strongly recommended to upgrade to the latest version (LLS-2.8.1.24092R).

  • BehobenSICK LIDAR-LOC with Firmware < LLS-2.8.1.24092Rsick_psirt

    On Microsoft Windows systems, it is strongly recommended to upgrade to the latest version (LLS-2.8.1.24092R).

  • BehobenDesigo CC family V5.0siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V5.1siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V6siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V7siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V8siemens_psirt

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109997962/
  • BehobenSENTRON Powermanager V5siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V6siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V7siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V8siemens_psirt

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771760/
  • BehobenSIMATIC PDM Maintenance Station V5.0siemens_psirt

    Update to V5.0 SP2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/110004810/
  • BehobenSIMATIC WinCC OA V3.18siemens_psirt

    Update to V3.18 P032 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109994004/
  • BehobenSIMATIC WinCC OA V3.19siemens_psirt

    Update to V3.19 P020 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989640/
  • BehobenSIMATIC WinCC OA V3.20siemens_psirt

    Update to V3.20 P008 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109990967/
  • Behobenphoenix_contact_psirt

    PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V8.30a, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V8.30a has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage. Additional Recommendations: Regularly check the product's official webpage for updated release versions that support CodeMeter V8.30a. Update the Activation Wizard to version 1.8 as soon as it becomes available on the product's download page.

  • BehobenOseontrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenProgramming Tubetrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenTRUMPF License Experttrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenTecZone Bendtrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenTruTops Boosttrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenTruTops Celltrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenTruTops Weldtrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • BehobenSIMATIC PDM Maintenance Station V5.0cisa_csaf_ot

    Update to V5.0 SP2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/110004810/
  • BehobenSIMATIC WinCC OA V3.18cisa_csaf_ot

    Update to V3.18 P032 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109994004/
  • BehobenSIMATIC WinCC OA V3.19cisa_csaf_ot

    Update to V3.19 P020 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989640/
  • BehobenSIMATIC WinCC OA V3.20cisa_csaf_ot

    Update to V3.20 P008 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109990967/
  • BehobenDesigo CC family V5.0cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V5.1cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V6cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V7cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V8cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V5cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V6cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V7cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V8cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V8cisa_csaf_ot

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109997962/
  • BehobenSENTRON Powermanager V8cisa_csaf_ot

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771760/
  • Mitigationphoenix_contact_psirt

    After installing the CodeMeter Control Center (at least once), please perform one of the following actions: - Restart your system - Log-out and log-in in - Manually close or restart the CodeMeter Control Center via the system tray icon These steps must be followed immediately after installing the CodeMeter Runtime or any product that includes the CodeMeter Runtime.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.2
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · cve@mitre.org USAusnutzbarkeit 1.5 · Auswirkung 6
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.17.7highCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:Hsecondary · SICK PSIRT DE
v3.17.5highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · TRUMPF PSIRT
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-269USCWE-272USCWE-272USCWE-272USCWE-272USCWE-272USCWE-272US
05

betroffene Produkte (200)

Betroffene Produkte und Versionsbereiche.

20 von 200 angezeigt
06

Advisories (11)

Hersteller- und Ökosystem-Meldungen dazu.

  • NCSC-2025-0246Kwetsbaarheden verholpen in Siemens productenNL2025-08-12csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als SIMATIC, SINEC, SIMAC, RUGGEDCOM, SIMOTION, SINAMICS, SIPROTEC en SINUMERIK.

  • NCSC-2026-0346Kwetsbaarheden verholpen in Siemens productenNL2026-09-08csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.

  • SCA-2025-0014CodeMeter vulnerablity affects SICK CODE-LOC and SICK LIDAR-LOC2025-11-03csaf · sick_psirtDE

    A vulnerability in the CodeMeter runtime affects the SICK products SICK CODE-LOC and SICK LIDAR-LOC. This could potentially affect the integrity, confidentiality and availability of the products. Only systems running on Microsoft Windows are affected. Furthermore, the systems are only affected when running the installation and keeping the Control Center component open. As soon as the system has been restarted, it is no longer affected by the vulnerability. Nevertheless, SICK strongly recommends to upgrade to the latest version of the products to mitigate the risk. Currently, SICK is not aware of any public exploits.

  • SSA-201595SSA-201595: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager2025-08-14csaf · siemens_psirtDE

    Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

  • SSA-331739SSA-331739: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products2025-08-12csaf · siemens_psirtDE

    WIBU Systems published information about a privilege escalation vulnerability under a certain circumstances and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • VDE-2025-064Phoenix Contact: Products utilizing WIBU-SYSTEMS CodeMeter Runtime Windows Installer have a privilege escalation2025-09-09csaf · phoenix_contact_psirtDE

    A local privilege escalation vulnerability in Phoenix Contact products utilizing WIBU-SYSTEMS CodeMeter Runtime allows users to gain admin rights on freshly installed systems. The CodeMeter Control Center starts with elevated privileges and retains them until restarted, enabling unauthorized access to admin tools like cmd.exe.

  • VDE-2026-007TRUMPF: Multiple products affected by Wibu CodeMeter vulnerability2026-02-23csaf · trumpf_psirtDE

    The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.

  • WID-SEC-W-2025-1076Wibu-Systems CodeMeter: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2025-05-15csaf · cert_bundDE

    Ein lokaler Angreifer kann eine Schwachstelle in Wibu-Systems CodeMeter ausnutzen, um seine Privilegien zu erhöhen.

  • ICSA-25-226-05Siemens IAM Client2025-08-12icsa · cisa_csaf_otUS

    WIBU Systems published information about a privilege escalation vulnerability under a certain circumstances and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • ICSA-25-231-01Siemens Desigo CC Product Family and SENTRON Powermanager2025-08-14icsa · cisa_csaf_otUS

    Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

  • ICSA-25-231-02Siemens Mendix SAML Module2025-08-14icsa · cisa_csaf_otUS

    Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcert_bundcisa_csaf_otncsc_nlsick_psirtsiemens_psirtphoenix_contact_psirttrumpf_psirtNVDCVE.orgMITRE
veröffentlicht 2025-05-16geändert 2026-09-08
09

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan