CVE-2021-20093
mediumpriority · attend · 48EPSS 0.333 · 98 %ileDEEURUUSEPSS · scored 2026-10-27
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedFieldEchosick_psirt
Update to latest version
https://www.sick.com/de/de/sick-integrationspace/software-for-integration/fieldecho/fieldechoc2ae/p/p597264 - FixedDesigo CC family V5.0siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedDesigo CC family V5.1siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedDesigo CC family V6siemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedSENTRON powermanagersiemens_psirt
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedPSS(R)CAPEsiemens_psirt
CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- FixedSIMATIC Information Serversiemens_psirt
Update SIMATIC PCS neo to V3.1 or later version
- FixedSIMATIC PCS neosiemens_psirt
Update to V3.1 or later version
- FixedSIMATIC Process Historian (incl. Process Historian OPC UA Server)siemens_psirt
Update SIMATIC PCS neo to V3.1 or later version
- FixedSIMATIC WinCC OA V3.17siemens_psirt
Update to V3.17 P013 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSIMATIC WinCC OA V3.18siemens_psirt
Update to V3.18 P002 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSIMIT Simulation Platformsiemens_psirt
Alternatively, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems.
https://support.industry.siemens.com/cs/ww/en/view/109800638/ - FixedSINEC INSsiemens_psirt
Alternatively, update CodeMeter Runtime to V7.21a: Download the package "CodeMeter User Runtime for Linux, version 7.21a, Driver-only" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command: "sudo dpkg --force-depends --force-confnew -i codemeter-7.21.4611.501_amd64.deb"
https://support.industry.siemens.com/cs/ww/en/view/109806100/ - FixedSINEMA Remote Connect Serversiemens_psirt
Update to V3.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/ - Fixede!COCKPIT engineering software installation bundleswago_psirt
We strongly encourage e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. During the WIBU-SYSTEMS Codemeter installation process, refer to the recommended setup settings according to the WIBU-SYSTEMS advisories, a brief summary is provided in the chapter mitigation. Please check for updates and details that may not be included in this document. WAGO will provide updated e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) setup routines with the latest WIBU-SYSTEMS Codemeter version in Q4/2021.
- Fixedendress_hauser_psirt
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- FixedPSS(R)CAPEcisa_csaf_ot
CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- FixedSIMATIC Information Servercisa_csaf_ot
Update SIMATIC PCS neo to V3.1 or later version
- FixedSIMATIC PCS neocisa_csaf_ot
Update to V3.1 or later version
- FixedSIMATIC Process Historian (incl. Process Historian OPC UA Server)cisa_csaf_ot
Update SIMATIC PCS neo to V3.1 or later version
- FixedSIMATIC WinCC OA V3.17cisa_csaf_ot
Update to V3.17 P013 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSIMATIC WinCC OA V3.18cisa_csaf_ot
Update to V3.18 P002 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSIMIT Simulation Platformcisa_csaf_ot
Alternatively, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems.
https://support.industry.siemens.com/cs/ww/en/view/109800638/ - FixedSINEC INScisa_csaf_ot
Alternatively, update CodeMeter Runtime to V7.21a: Download the package "CodeMeter User Runtime for Linux, version 7.21a, Driver-only" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command: "sudo dpkg --force-depends --force-confnew -i codemeter-7.21.4611.501_amd64.deb"
https://support.industry.siemens.com/cs/ww/en/view/109806100/ - FixedSINEMA Remote Connect Servercisa_csaf_ot
Update to V3.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/ - FixedDesigo CC family V5.0cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedDesigo CC family V5.1cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedDesigo CC family V6cisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- FixedSENTRON powermanagercisa_csaf_ot
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- MitigationPSS(R)CAPEsiemens_psirt
If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.
- MitigationSICAM 230siemens_psirt
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
- MitigationSIMATIC Information Serversiemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC PCS neosiemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC Process Historian (incl. Process Historian OPC UA Server)siemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC WinCC OA V3.17siemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
- MitigationSIMATIC WinCC OA V3.18siemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
- MitigationSINEC INSsiemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
- MitigationSINEMA Remote Connect Serversiemens_psirt
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
- Mitigationwago_psirt
1. Use general security best practices to protect systems from local and network attacks. 2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication 3. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. 4. If it is not possible to disable the network server, using a host-based firewall to restrict access to the CmLAN port can reduce the risk. 5. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed. 6. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. 7. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port. For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://wibu.com/support/security-advisories.html
- Mitigationendress_hauser_psirt
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- MitigationPSS(R)CAPEcisa_csaf_ot
If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.
- MitigationSICAM 230cisa_csaf_ot
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
- MitigationSIMATIC Information Servercisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC PCS neocisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC Process Historian (incl. Process Historian OPC UA Server)cisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC WinCC OA V3.17cisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
- MitigationSIMATIC WinCC OA V3.18cisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
- MitigationSINEC INScisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
- MitigationSINEMA Remote Connect Servercisa_csaf_ot
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
- No fix plannedSICAM 230siemens_psirt
Currently no remediation is planned
- No fix plannedSICAM 230cisa_csaf_ot
Currently no remediation is planned
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (91)
Products and version ranges known to be affected.
- Siemens PSS(R)CAPE≤ CAPE_14_installations_installed_from_material_dated_earlier_than_2021-06-16cisa_csaf_otUS
advisories (7)
Vendor and ecosystem advisories describing this.
- SCA-2022-0001Vulnerability in SICK FieldEcho2022-02-17csaf · sick_psirtDE
WIBU publicly released an advisory for the WIBU product “CodeMeter Runtime Network Server”. The advisory discloses a buffer over-read vulnerability that was found in the WIBU product “CodeMeter Runtime Network Server”. By default the network server functionality is disabled, however the SICK product “FieldEcho” may be vulnerable, if customers enables this. SICK has released a new FieldEcho version and recommends updating to the newest version. Since version 1.5.2 of SICK “FieldEcho”, customer can choose to use their own license server. If so, SICK advises to take action in accordance with the official WIBU Security Advisory.
- SSA-625850SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager2023-11-14csaf · siemens_psirtDE
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
- SSA-675303SSA-675303: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products2021-07-13csaf · siemens_psirtDE
WIBU Systems published information about two vulnerabilities and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2021-20093 and CVE-2021-20094. Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- VDE-2021-043WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro2021-08-31csaf · wago_psirtDE
Multiple vulnerabilities were reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installation bundles with Version 2.3.9.46, 2.3.9.47, 2.3.9.49, 2.3.9.53, 2.3.9.55, 2.3.9.61 and 2.3.9.66 contain vulnerable versions of WIBU-SYSTEMS Codemeter.
- VDE-2022-019Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components2022-06-02csaf · endress_hauser_psirtDE
For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.
- ICSA-21-210-02Wibu-Systems CodeMeter Runtime2021-07-13icsa · cisa_csaf_otUS
WIBU Systems published information about two vulnerabilities and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2021-20093 and CVE-2021-20094. Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- ICSA-23-320-03Siemens Desigo CC product family2023-11-14icsa · cisa_csaf_otUS
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02cnnvd
- https://vigilance.fr/vulnerability/WIBU-Systems-CodeMeter-buffer-overflow-35870cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2575cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021073002cnnvd
- https://www.tenable.com/security/research/tra-2021-24cnnvd
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan