CVE-2020-14513

mediumpriority · track · 31EPSS 0.016 · 75 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.56% (75th) EPSS
CVSS 5 · medium
Is it mine?
52 products
Check your exposure
Who says so?
11 sources
cnnvd · enisa_euvd · cisa_csaf_ot · endress_hauser_psirt

EPSS · scored 2026-10-23

CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedPSS CAPE Protection Simulation Platformsiemens_psirt

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedSIMATIC PCS neosiemens_psirt

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)siemens_psirt

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMIT Simulation Platformsiemens_psirt

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSINEMA Remote Connectsiemens_psirt

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793790/
  • Fixedendress_hauser_psirt

    WIBU SYSTEMS has released a new Code Meter Runtime version 7.10a dated on 16.9.2020. All the known vulnerabilities are fixed with this version. The version is available at https://www.wibu.com/support

  • Fixede!COCKPIT engineering software installation bundleswago_psirt

    We strongly encourage e!COCKPIT users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. During the WIBU-SYSTEMS Codemeter installation process, refer to the recommended setup settings according to the WIBU-SYSTEMS advisories, a brief summary is provided in the chapter mitigation. Please check for updates and details that may not be included in this document. WAGO will provide an updated e!COCKPIT setup routine with the latest WIBU-SYSTEMS Codemeter version approximately in Q4/2020.

  • Fixedpilz_psirt

    Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.

  • Fixedpepperl_fuchs_psirt

    For VMT MSS Update to WIBU Systems CodeMeter Runtime 7.10 . For VMT IS Please contact VMT GmbH to receive support for the product update process.

  • FixedPMC programming tool 3.x.xpilz_psirt

    Installation of the software version 3.5.17

  • FixedCodeMetercisa_csaf_ot

    For more information on products dependent on the affected CodeMeter see the following vendor security advisories:

    https://cert.vde.com/en-us/advisories/vde-2020-041
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationPSS CAPE Protection Simulation Platformsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230siemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neosiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)siemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platformsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEMA Remote Connectsiemens_psirt

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • Mitigationendress_hauser_psirt

    Most vulnerabilities have already been fixed in the current Code Meter versions 7.10. Use of this version requires additional mitigation measures to fix all CVEs. For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

  • Mitigatione!COCKPIT engineering software installation bundleswago_psirt

    1. Use general security best practices to protect systems from local and network attacks. 2. Disable the WIBU-SYSTEMS CodeMeter Runtime WebSockets API. 3. Run WIBU-SYSTEMS CodeMeter only as client and use localhost as binding for the WIBU-SYSTEMS CodeMeter communication. If you need to operate WIBU-SYSTEMS CodeMeter Runtime as Network License Server please make sure that it is operated in a secure environment. For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://www.wibu.com/support/security-advisories.html Further details on the corresponding CVEs can be obtained here: https://www.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-200521-01.pdf

  • Mitigationpepperl_fuchs_psirt

    In general and without any update, this product can be operated in a secure local network that has no connection to an untrusted network, like internet or global corporate IT-net.

  • MitigationTRUMPF CAD/CAM software toolstrumpf_psirt

    - Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.

  • MitigationPMC programming tool 3.x.xpilz_psirt

    Use a hardware firewall, host-based firewall or comparable measures at network level toprotect against unauthorised network communication with the PC. Use a virus scanner or other measures to protect against malware. Only use CODESYS libraries and archives from trusted sources.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • No fix availablePMC programming tool 2.x.xpilz_psirt

    No product-specific countermeasures available, please follow the general countermeasures or migrate your application to the CODESYS V3 runtime system.

  • No fix plannedSICAM 230siemens_psirt

    Currently no remediation is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · WAGO PSIRT DE
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Pepperl+Fuchs PSIRT DE
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Endress+Hauser PSIRT DE
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Pilz PSIRT DE
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Festo PSIRT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · TRUMPF PSIRT
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-20US
04

affected products (52)

Products and version ranges known to be affected.

showing 20 of 52
05

advisories (11)

Vendor and ecosystem advisories describing this.

  • FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • SSA-455843SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products2020-09-08csaf · siemens_psirtDE

    CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • VDE-2020-031Endress+Hauser: Multiple products prone to WIBU CodeMeter vulnerabilities2020-10-27csaf · endress_hauser_psirtDE

    For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html and the aforementioned CVE-IDs.

  • VDE-2020-032WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT2020-09-09csaf · wago_psirtDE

    Multiple vulnerabilties were reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT installation. All currently existing e!COCKPIT installation bundles contain vulnerable versions of WIBU-SYSTEMS Codemeter.

  • VDE-2020-033Pilz: Multiple products prone to WIBU-SYSTEMS CodeMeter vulnerabilities2020-09-10csaf · pilz_psirtDE

    A number of Pilz software tools use the Software CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to change and falsify a licence file, prevent normal operation of Code- Meter (Denial-of-Service) and potentially execute arbitrary code.

  • VDE-2020-034Pepperl+Fuchs: VMT MSS and VMT IS - Several vulnerabilities in products utilizing WIBU-SYSTEMS CodeMeter components2020-09-10csaf · pepperl_fuchs_psirtDE

    Several vulnerabilities have been discovered in the utilized component WIBU-SYSTEMS CodeMeter Runtime. For detailed information please refer to WIBU-SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html

  • VDE-2020-039TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities2020-10-27csaf · trumpf_psirtDE

    A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.

  • VDE-2021-055Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities2022-04-26csaf · pilz_psirtDE

    The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.

  • VDE-2021-061Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities2022-04-26csaf · pilz_psirtDE

    The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.

  • ICSA-20-203-01Wibu-Systems CodeMeter (Update F)2020-08-20icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, potentially attain remote code execution, read heap data, and prevent normal operation of third-party software dependent on the CodeMeter.

  • ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otendress_hauser_psirtfesto_psirtnvdsiemens_psirtwago_psirtpilz_psirtpepperl_fuchs_psirttrumpf_psirtNVDCVE.orgMITRE
published 2020-09-16modified 2026-06-17
08

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan