NewsSiemens ProductCERT

    SSA-240541 V1.0: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products

    Share
    WIBU Systems published information about a heap buffer overflow vulnerability and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products for license management. The vulnerability is described in the section “Vulnerability Classification” below and got assigned the CVE ID CVE-2023-3935. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute code on vulnerable products, where CodeMeter Runtime (i.e., CodeMeter.exe) is configured as a server, or an authenticated local attacker to gain root/admin privileges on vulnerable products, where CodeMeter Runtime is configured as a client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet available.

    Linked advisories

    Affected vendors and products

    More on CodeMeter

    Other advisories

    Other news entries

    Source: https://cert-portal.siemens.com/productcert/html/ssa-240541.html

    ID