Full Report
CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section “Vulnerability Classification” below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Multiple Flaws in Wibu-Systems CodeMeter Runtime affecting Siemens Products
## CVE Details
* **CVE-2020-14509** | CVSS: 10.0 (Critical) | CWE-121: Stack-based Buffer Overflow
* **CVE-2020-16233** | CVSS: 7.5 (High) | CWE-125: Out-of-bounds Read
* **CVE-2020-14519** | CVSS: 8.1 (High) | CWE-327: Use of a Broken or Risky Cryptographic Algorithm
* **CVE-2020-14513** | CVSS: 7.5 (High) | CWE-20: Improper Input Validation
* **CVE-2020-14517** | CVSS: 9.4 (Critical) | CWE-693: Protection Mechanism Failure
* **CVE-2020-14515** | CVSS: 7.4 (High) | CWE-522: Insufficiently Protected Credentials
## Affected Systems
* **Products:** Wibu-Systems CodeMeter Runtime (integrated into various Siemens industrial software products for license management).
* **Versions:** CodeMeter Runtime versions prior to v7.10.
* **Configurations:** Systems where the CodeMeter network server is enabled (typically via port 22350/TCP) or where the CodeMeter service is running to manage Siemens software licenses.
## Vulnerability Description
These vulnerabilities stem from improper handling of memory and cryptographic protocols within the CodeMeter communication stack.
* **Remote Code Execution (RCE):** The most severe flaws (e.g., CVE-2020-14509) involve buffer overflows where specially crafted packets sent to the CodeMeter server can lead to arbitrary code execution with system privileges.
* **Cryptographic Weaknesses:** Use of weak or broken algorithms allows attackers to forge or alter license files (CVE-2020-14519) or bypass signature checks (CVE-2020-14517).
* **Information Disclosure:** Out-of-bounds reads (CVE-2020-16233) can allow an attacker to crash the service or leak sensitive memory contents.
## Exploitation
* **Status:** Publicly disclosed; PoC details have been discussed in security research circles.
* **Complexity:** Low to Medium.
* **Attack Vector:** Network (Remote exploitation is possible if the CodeMeter port is accessible).
## Impact
* **Confidentiality:** High (Potential for credential theft and memory leakage).
* **Integrity:** High (Ability to forge/alter licenses and execute unauthorized code).
* **Availability:** High (Denial-of-Service (DoS) and system crashes).
## Remediation
### Patches
* **Wibu-Systems:** Update CodeMeter Runtime to **version 7.10 or later**.
* **Siemens:** Users should check the Siemens ProductCERT portal for specific updates for integrated products like TIA Portal, SIMATIC, and others that bundle CodeMeter.
### Workarounds
* **Network Filtering:** Block access to port 22350/TCP at the network firewall if remote license management is not required.
* **Local Restriction:** Configure the CodeMeter service to only listen on `127.0.0.1` (localhost) to prevent network-based attacks.
* **Run as Least Privilege:** Where possible, ensure the runtime environment limits the impact of potential service exploitation.
## Detection
* **Indicators of Compromise:** Unusual traffic on TCP port 22350; unexpected crashes of `CodeMeter.exe`.
* **Detection Methods:**
* Monitor for unauthorized modifications to `.WibuCmRaU` license files.
* Use vulnerability scanners to identify outdated versions of the CodeMeter executable.
## References
* Siemens Security Advisory: hxxps[://]www[.]siemens[.]com/cert/advisories
* CISA Advisory (ICSA-20-247-01): hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-20-247-01
* Wibu-Systems Security Page: hxxps[://]www[.]wibu[.]com/support/security-advisories[.]html