CVE-2025-47809

highpriority · track · 0EPSS 0.002 · 7 %ileDEEUNLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.18% (7th) EPSS
CVSS 8.2 · high
Is it mine?
200 products
Check your exposure
Who says so?
9 sources
cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-26

Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSICK CODE-LOC with Firmware < LLS-2.8.1.24092Rsick_psirt

    On Microsoft Windows systems, it is strongly recommended to upgrade to the latest version (LLS-2.8.1.24092R).

  • FixedSICK LIDAR-LOC with Firmware < LLS-2.8.1.24092Rsick_psirt

    On Microsoft Windows systems, it is strongly recommended to upgrade to the latest version (LLS-2.8.1.24092R).

  • FixedDesigo CC family V5.0siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V5.1siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V6siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V7siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V8siemens_psirt

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109997962/
  • FixedSENTRON Powermanager V5siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V6siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V7siemens_psirt

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V8siemens_psirt

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771760/
  • FixedSIMATIC PDM Maintenance Station V5.0siemens_psirt

    Update to V5.0 SP2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/110004810/
  • FixedSIMATIC WinCC OA V3.18siemens_psirt

    Update to V3.18 P032 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109994004/
  • FixedSIMATIC WinCC OA V3.19siemens_psirt

    Update to V3.19 P020 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989640/
  • FixedSIMATIC WinCC OA V3.20siemens_psirt

    Update to V3.20 P008 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109990967/
  • Fixedphoenix_contact_psirt

    PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V8.30a, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V8.30a has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage. Additional Recommendations: Regularly check the product's official webpage for updated release versions that support CodeMeter V8.30a. Update the Activation Wizard to version 1.8 as soon as it becomes available on the product's download page.

  • FixedOseontrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedProgramming Tubetrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedTRUMPF License Experttrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedTecZone Bendtrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedTruTops Boosttrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedTruTops Celltrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedTruTops Weldtrumpf_psirt

    New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

  • FixedSIMATIC PDM Maintenance Station V5.0cisa_csaf_ot

    Update to V5.0 SP2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/110004810/
  • FixedSIMATIC WinCC OA V3.18cisa_csaf_ot

    Update to V3.18 P032 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109994004/
  • FixedSIMATIC WinCC OA V3.19cisa_csaf_ot

    Update to V3.19 P020 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989640/
  • FixedSIMATIC WinCC OA V3.20cisa_csaf_ot

    Update to V3.20 P008 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109990967/
  • FixedDesigo CC family V5.0cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V5.1cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V6cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V7cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V8cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V5cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V6cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V7cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedSENTRON Powermanager V8cisa_csaf_ot

    Apply patch as documented in section 'Additional Information'

  • FixedDesigo CC family V8cisa_csaf_ot

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109997962/
  • FixedSENTRON Powermanager V8cisa_csaf_ot

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771760/
  • Mitigationphoenix_contact_psirt

    After installing the CodeMeter Control Center (at least once), please perform one of the following actions: - Restart your system - Log-out and log-in in - Manually close or restart the CodeMeter Control Center via the system tray icon These steps must be followed immediately after installing the CodeMeter Runtime or any product that includes the CodeMeter Runtime.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.2
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · cve@mitre.org USexploitability 1.5 · impact 6
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.17.7highCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:Hsecondary · SICK PSIRT DE
v3.17.5highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · TRUMPF PSIRT
v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USCWE-272USCWE-272USCWE-272USCWE-272USCWE-272USCWE-272US
05

affected products (200)

Products and version ranges known to be affected.

showing 20 of 200
06

advisories (11)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0246Kwetsbaarheden verholpen in Siemens productenNL2025-08-12csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als SIMATIC, SINEC, SIMAC, RUGGEDCOM, SIMOTION, SINAMICS, SIPROTEC en SINUMERIK.

  • NCSC-2026-0346Kwetsbaarheden verholpen in Siemens productenNL2026-09-08csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.

  • SCA-2025-0014CodeMeter vulnerablity affects SICK CODE-LOC and SICK LIDAR-LOC2025-11-03csaf · sick_psirtDE

    A vulnerability in the CodeMeter runtime affects the SICK products SICK CODE-LOC and SICK LIDAR-LOC. This could potentially affect the integrity, confidentiality and availability of the products. Only systems running on Microsoft Windows are affected. Furthermore, the systems are only affected when running the installation and keeping the Control Center component open. As soon as the system has been restarted, it is no longer affected by the vulnerability. Nevertheless, SICK strongly recommends to upgrade to the latest version of the products to mitigate the risk. Currently, SICK is not aware of any public exploits.

  • SSA-201595SSA-201595: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager2025-08-14csaf · siemens_psirtDE

    Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

  • SSA-331739SSA-331739: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products2025-08-12csaf · siemens_psirtDE

    WIBU Systems published information about a privilege escalation vulnerability under a certain circumstances and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • VDE-2025-064Phoenix Contact: Products utilizing WIBU-SYSTEMS CodeMeter Runtime Windows Installer have a privilege escalation2025-09-09csaf · phoenix_contact_psirtDE

    A local privilege escalation vulnerability in Phoenix Contact products utilizing WIBU-SYSTEMS CodeMeter Runtime allows users to gain admin rights on freshly installed systems. The CodeMeter Control Center starts with elevated privileges and retains them until restarted, enabling unauthorized access to admin tools like cmd.exe.

  • VDE-2026-007TRUMPF: Multiple products affected by Wibu CodeMeter vulnerability2026-02-23csaf · trumpf_psirtDE

    The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.

  • WID-SEC-W-2025-1076Wibu-Systems CodeMeter: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2025-05-15csaf · cert_bundDE

    Ein lokaler Angreifer kann eine Schwachstelle in Wibu-Systems CodeMeter ausnutzen, um seine Privilegien zu erhöhen.

  • ICSA-25-226-05Siemens IAM Client2025-08-12icsa · cisa_csaf_otUS

    WIBU Systems published information about a privilege escalation vulnerability under a certain circumstances and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • ICSA-25-231-01Siemens Desigo CC Product Family and SENTRON Powermanager2025-08-14icsa · cisa_csaf_otUS

    Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

  • ICSA-25-231-02Siemens Mendix SAML Module2025-08-14icsa · cisa_csaf_otUS

    Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundcisa_csaf_otncsc_nlsick_psirtsiemens_psirtphoenix_contact_psirttrumpf_psirtNVDCVE.orgMITRE
published 2025-05-16modified 2026-09-08
09

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan