CVE-2021-41057
lowpriority · track · 28EPSS 0.003 · 22 %ileDEEURUUSEPSS · scored 2026-10-27
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedfesto_psirt
FluidDraw P5, FluidDraw P6 Avoid any FluidDraw installation with a FluidDraw installation package below version 6.2c. Updated versions of FluidDraw are available on the Festo website. In case of a FluidDraw installation package with a version below 6.2c, do not use the WIBU CodeMeter package, that is part of the FluidDraw installation package. Skip the CodeMeter installation step during the FluidDraw installation and instead use a current CodeMeter version from the WIBU website and install that separately. In case of an already installed vulnerable CodeMeter version, update all of these WIBU CodeMeter installations with the current version of WIBU CodeMeter. Please refer to the WIBU CodeMeter documentation and website for further details and mitigations on usage of WIBU CodeMeter Runtime before 7.30a. CIROS For future installations, ensure you're using a CIROS installer downloaded from https://ip.festo-didactic.com/ Infoportal/CIROS/EN/Download.html after September 15, 2022. For existing installations, update the WIBU CodeMeter Runtime separately with at least version 7.30a downloaded from the WIBU Systems website. Please refer to the WIBU CodeMeter documentation and website for further details and mitigations on usage of WIBU CodeMeter Runtime before 7.30a. MES PC If your copy of MES4 came preinstalled on a PC shipped before December 2022, you'll need to make sure this PC has at least CodeMeter Runtime 7.30a installed. If necessary, download the update from the WIBU Systems website. Additional to the above: Festo strongly recommends to restrict unprivileged access to machines running Festo software and to minimize and protect network access to connected devices with state of the art techniques and processes. For a secure operation follow the recommendations in the product manuals.
- FixedPSS(R)CAPEsiemens_psirt
CAPE 14 installations installed from material dated 2021-10-05 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- FixedPSS(R)E V34siemens_psirt
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - FixedPSS(R)E V35siemens_psirt
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - FixedPSS(R)ODMS V12siemens_psirt
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - FixedSICAM 230siemens_psirt
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_2: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_S VA_2021_2.pdf.
- FixedSIMATIC Information Serversiemens_psirt
To update, use the Information Server version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
- FixedSIMATIC PCS neosiemens_psirt
Update to V3.1 Upd 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109804750/ - FixedSIMATIC Process Historian (incl. Process Historian OPC UA Server)siemens_psirt
To update, use the Process Historian version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
- FixedSIMATIC WinCC OA V3.17siemens_psirt
Update to V3.17 P015 or later version
https://www.winccoa.com/downloads/category/versions- patches.html - FixedSIMATIC WinCC OA V3.18siemens_psirt
Update to V3.18 P005 or later version
https://www.winccoa.com/downloads/category/versions- patches.html - FixedSIMIT Simulation Platformsiemens_psirt
Update to V11.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810223/ - Fixedwago_psirt
We strongly encourage e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. WAGO will provide updated e!COCKPIT setup routines (Version 1.11) with the latest WIBU- SYSTEMS Codemeter version in Q2/2022. Additionally WAGO will provide a security patch for e!COCKPIT Version 1.10 in February 2022.WAGO will provide updated WAGO-I/O-Pro (CODESYS 2.3) (Version 2.3.9.68) setup routines with the latest WIBU-SYSTEMS Codemeter version in Q1/2022. For further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Advisory WIBU-210910-01 at Website https://www.wibu.com/support/security-advisories.html. Further details on the corresponding CVEs can be obtained here:https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf
- Fixedendress_hauser_psirt
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
- FixedCodeMeter Runtimecisa_csaf_ot
For more information on products dependent on the affected CodeMeter see the following vendor security advisories:
https://www.wibu.com/support/security-advisories.html - MitigationSIMATIC Information Serversiemens_psirt
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC PCS neosiemens_psirt
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC Process Historian (incl. Process Historian OPC UA Server)siemens_psirt
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC WinCC OA V3.17siemens_psirt
Limit local access to the WinCC OA server by hardening measures according to the security guideline.
- MitigationSIMATIC WinCC OA V3.18siemens_psirt
Limit local access to the WinCC OA server by hardening measures according to the security guideline.
- Mitigationwago_psirt
Mitigation Use general security best practices to protect systems from local and network attacks. Disable the container type 'Mass Storage' in CodeMeter via the Windows Registry.
- Mitigationendress_hauser_psirt
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.
- No fix plannedSICAM 230siemens_psirt
Currently no fix is planned
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.6–7.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (87)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- FSA-202206Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in multiple products2022-12-13csaf · festo_psirtDE
A vulnerability was reported in WIBU-SYSTEMS CodeMeter Runtime. WIBU-SYSTEMS CodeMeter Runtime is part of the installation packages of several Festo products.FluidDraw < 6.2c and CIROS <= 7.0.6 contain a vulnerable version of WIBU-SYSTEMS CodeMeter Runtime.
- SSA-580693SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products2021-11-09csaf · siemens_psirtDE
WIBU Systems published information about a denial-of-service vulnerability and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerability is described in the section "Vulnerability Classification" below and got assigned the CVE ID CVE-2021-41057. Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server (i.e., CodeMeter.exe), which could cause a denial-of-service condition for the affected Siemens product. Siemens has released updates for the affected products and recommends to update to the latest versions.
- VDE-2022-002WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro2022-01-31csaf · wago_psirtDE
A vulnerability is reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installation bundles are affected with vulnerable versions of WIBU-SYSTEMS Codemeter.
- VDE-2022-019Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components2022-06-02csaf · endress_hauser_psirtDE
For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.
- ICSA-21-350-03Wibu-Systems CodeMeter Runtime2021-12-16icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server, which could cause a denial-of-service condition.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdfcnnvd
- https://new.siemens.com/global/en/products/automation/systems/industrial/plc.html。Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-41057cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-350-03cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-denial-of-service-via-WIBU-Systems-CodeMeter-Runtime-36834cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4286cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022010503cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan