CVE-2020-14509

highpriority · track · 40EPSS 0.021 · 81 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
2.07% (81st) EPSS
CVSS 7.5 · high
Is it mine?
54 products
Check your exposure
Who says so?
13 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedPSS CAPE Protection Simulation Platformsiemens_psirt

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedSIMATIC Information Server 2019siemens_psirt

    Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neosiemens_psirt

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)siemens_psirt

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC WinCC OAsiemens_psirt

    Update to V3.17 P007 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMIT Simulation Platformsiemens_psirt

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSINEC INSsiemens_psirt

    Update to V1.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793469/
  • Fixedphoenix_contact_psirt

    WIBU-SYSTEMS has released a new CodeMeter Runtime version 7.10 to fix the known vulnerabilities and may continue to release further updated versions in the future. Phoenix Contact has released a new version of Activation Wizard 1.3.2, used for activation and deactivation of licenses, installing CodeMeter Runtime 7.10 on Windows PCs. After installation of Activation Wizard 1.3.2 all installed products using CodeMeter Runtime will use the latest CodeMeter Runtime 7.10 version. Activation Wizard 1.3.2 contains the official fix of WIBU-SYSTEMS for the known variabilities and is disabling the WebSockets API like recommended by WIBU-SYSTEMS. We strongly recommend downloading and installing Activation Wizard 1.3.2 or higher as the CVSS Score of the vulnerabilities are critical and high. Activation Wizard is available via the download areas of PLCnext Engineer, FL Network Manager, or EV Charging Suite. Since there can only be one installation of CodeMeter Runtime on a system, installing the latest version of CodeMeter Runtime as being included in Activation Wizard will fix the vulnerabilities for all other applications using CodeMeter Runtime as well. Please check your products web site for further updates regularly or register to Phoenix Contact PSIRT information's to receive latest updates about security advisories. Phoenix Contact recommends following security best practices to protect systems from local and network attacks as described in the application note AH EN INDUSTRIAL SECURITY.

  • Fixedendress_hauser_psirt

    WIBU SYSTEMS has released a new Code Meter Runtime version 7.10a dated on 16.9.2020. All the known vulnerabilities are fixed with this version. The version is available at https://www.wibu.com/support

  • Fixede!COCKPIT engineering software installation bundleswago_psirt

    We strongly encourage e!COCKPIT users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. During the WIBU-SYSTEMS Codemeter installation process, refer to the recommended setup settings according to the WIBU-SYSTEMS advisories, a brief summary is provided in the chapter mitigation. Please check for updates and details that may not be included in this document. WAGO will provide an updated e!COCKPIT setup routine with the latest WIBU-SYSTEMS Codemeter version approximately in Q4/2020.

  • Fixedpepperl_fuchs_psirt

    For VMT MSS Update to WIBU Systems CodeMeter Runtime 7.10 . For VMT IS Please contact VMT GmbH to receive support for the product update process.

  • FixedPMC programming tool 3.x.xpilz_psirt

    Installation of the software version 3.5.17

  • FixedCodeMetercisa_csaf_ot

    For more information on products dependent on the affected CodeMeter see the following vendor security advisories:

    https://cert.vde.com/en-us/advisories/vde-2020-041
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationPSS CAPE Protection Simulation Platformsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230siemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Information Server 2019siemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neosiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)siemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC WinCC OAsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platformsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEC INSsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • Mitigationphoenix_contact_psirt

    Use general security best practices to protect systems from local and network attacks like described in the application note AH EN INDUSTRIAL SECURITY. Disable the CodeMeter Runtime WebSockets API. Run CodeMeter only as client and use localhost as binding for the CodeMeter communication. If you need to operate CodeMeter Runtime as Network License Server please make sure that it is operated in a secure environment. For detailed information please refer to WIBU Systems original Advisories.

  • Mitigationendress_hauser_psirt

    Most vulnerabilities have already been fixed in the current Code Meter versions 7.10. Use of this version requires additional mitigation measures to fix all CVEs. For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

  • Mitigatione!COCKPIT engineering software installation bundleswago_psirt

    1. Use general security best practices to protect systems from local and network attacks. 2. Disable the WIBU-SYSTEMS CodeMeter Runtime WebSockets API. 3. Run WIBU-SYSTEMS CodeMeter only as client and use localhost as binding for the WIBU-SYSTEMS CodeMeter communication. If you need to operate WIBU-SYSTEMS CodeMeter Runtime as Network License Server please make sure that it is operated in a secure environment. For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://www.wibu.com/support/security-advisories.html Further details on the corresponding CVEs can be obtained here: https://www.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-200521-03.pdf

  • Mitigationpepperl_fuchs_psirt

    In general and without any update, this product can be operated in a secure local network that has no connection to an untrusted network, like internet or global corporate IT-net.

  • MitigationTRUMPF CAD/CAM software toolstrumpf_psirt

    - Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.

  • Mitigationu-create studioweidmueller_psirt

    - Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.

  • MitigationPMC programming tool 3.x.xpilz_psirt

    Use a hardware firewall, host-based firewall or comparable measures at network level toprotect against unauthorised network communication with the PC. Use a virus scanner or other measures to protect against malware. Only use CODESYS libraries and archives from trusted sources.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • No fix availablePMC programming tool 2.x.xpilz_psirt

    No product-specific countermeasures available, please follow the general countermeasures or migrate your application to the CODESYS V3 runtime system.

  • No fix plannedSICAM 230siemens_psirt

    Currently no remediation is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

10.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–10

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.010criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · WAGO PSIRT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Weidmüller PSIRT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Pepperl+Fuchs PSIRT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Endress+Hauser PSIRT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Pilz PSIRT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Festo PSIRT DE
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · TRUMPF PSIRT
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805USCWE-805US
04

affected products (54)

Products and version ranges known to be affected.

showing 20 of 54
05

advisories (12)

Vendor and ecosystem advisories describing this.

  • FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • SSA-455843SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products2020-09-08csaf · siemens_psirtDE

    CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • VDE-2020-030PHOENIX CONTACT: Products utilizing WIBU-SYSTEMS CodeMeter components2020-09-09csaf · phoenix_contact_psirtDE

    Several vulnerabilities have been discovered in WIBU-SYSTEMS CodeMeter and published 08 September 2020. Phoenix Contact is only affected by a subset of these vulnerabilities. Phoenix Contact products are not affected by vulnerabilities WIBU-200521-01 (CVE-2020- 14513), WIBU-200521-04 (CVE-2020-14517, and WIBU-200521-06 (CVE-2020-14515). For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html

  • VDE-2020-031Endress+Hauser: Multiple products prone to WIBU CodeMeter vulnerabilities2020-10-27csaf · endress_hauser_psirtDE

    For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html and the aforementioned CVE-IDs.

  • VDE-2020-032WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT2020-09-09csaf · wago_psirtDE

    Multiple vulnerabilties were reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT installation. All currently existing e!COCKPIT installation bundles contain vulnerable versions of WIBU-SYSTEMS Codemeter.

  • VDE-2020-034Pepperl+Fuchs: VMT MSS and VMT IS - Several vulnerabilities in products utilizing WIBU-SYSTEMS CodeMeter components2020-09-10csaf · pepperl_fuchs_psirtDE

    Several vulnerabilities have been discovered in the utilized component WIBU-SYSTEMS CodeMeter Runtime. For detailed information please refer to WIBU-SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html

  • VDE-2020-039TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities2020-10-27csaf · trumpf_psirtDE

    A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.

  • VDE-2020-041Weidmueller: u-create studio < 1.20.2 affected by WIBU-SYSTEMS CodeMeter vulnerabilities2020-10-12csaf · weidmueller_psirtDE

    WIBU-SYSTEMS report multiple vulnerabilities in their CodeMeter Runtime software. As part of the Weidmüller u-create studio installation the WIBU-SYSTEMS CodeMeter is installed by default. As the u-create studio installation bundle contains vulnerable versions of WIBU-SYSTEMS CodeMeter, the u-create studio is affected by a subset of these vulnerabilities. For details refer to section "Impact".

  • VDE-2021-055Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities2022-04-26csaf · pilz_psirtDE

    The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.

  • VDE-2021-061Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities2022-04-26csaf · pilz_psirtDE

    The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.

  • ICSA-20-203-01Wibu-Systems CodeMeter (Update F)2020-08-20icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, potentially attain remote code execution, read heap data, and prevent normal operation of third-party software dependent on the CodeMeter.

  • ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otendress_hauser_psirtfesto_psirtsiemens_psirtphoenix_contact_psirtwago_psirtpepperl_fuchs_psirttrumpf_psirtweidmueller_psirtpilz_psirtNVDCVE.orgMITRE
published 2020-09-16modified 2026-06-17
08

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan