Full Report
WIBU Systems published information about a denial-of-service vulnerability and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerability is described in the section “Vulnerability Classification” below and got assigned the CVE ID CVE-2021-41057. Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server (i.e., CodeMeter.exe), which could cause a denial-of-service condition for the affected Siemens product. Siemens has released updates for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Denial-of-Service in WIBU Systems CodeMeter Runtime
## CVE Details
- **CVE ID:** CVE-2021-41057
- **CVSS Score:** 7.5 (High) - *Note: Based on standard NVD scoring for this specific CVE in CodeMeter.*
- **CWE:** CWE-400 (Uncontrolled Resource Consumption) / CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** WIBU Systems CodeMeter Runtime (integrated into various Siemens industrial and engineering products).
- **Versions:** All versions prior to CodeMeter Runtime v7.30a.
- **Configurations:** Systems where the CodeMeter Runtime Server (`CodeMeter.exe`) is running to manage licensing for Siemens software.
## Vulnerability Description
The vulnerability exists due to improper input validation within the CodeMeter Runtime Server. An attacker can send specially crafted packets to the CodeMeter communication interface. If the server fails to handle these malformed requests correctly, it leads to a crash of the `CodeMeter.exe` process. Because many Siemens products rely on this service for license verification, a crash of the runtime results in a Denial-of-Service (DoS) for the dependent Siemens applications.
## Exploitation
- **Status:** Not exploited in the wild (at time of report); No public PoC widely distributed in the provided context.
- **Complexity:** Low
- **Attack Vector:** Network (The vulnerability can typically be triggered over the network if the CodeMeter port—default TCP 22350—is accessible).
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Results in the termination of the license management service and associated software functionality).
## Remediation
### Patches
- **WIBU Systems:** Update CodeMeter Runtime to **v7.30a** or later.
- **Siemens Products:** Siemens has released specific updates for its affected product lines. Users should visit the Siemens ProductCERT portal to identify the specific update for their installed software (e.g., TIA Portal, STEP 7, etc.).
### Workarounds
- **Network Segmentation:** Block access to the CodeMeter Runtime port (default TCP 22350) from untrusted networks.
- **Access Control:** Restrict the CodeMeter communication to local communication only (localhost) if network licensing is not required.
- **Service Monitoring:** Implement a watchdog process to automatically restart the `CodeMeter.exe` service if it crashes, though this does not fix the root cause.
## Detection
- **Indicators of Compromise:** Unexpected termination or frequent crashing of the `CodeMeter.exe` process.
- **Detection methods and tools:** Monitor system logs for Application Errors related to `CodeMeter.exe`. Network IDS/IPS can be configured to look for anomalous traffic targeting TCP port 22350.
## References
- Siemens ProductCERT: hxxps[://]new[.]siemens[.]com/global/en/products/services/cert[.]html
- WIBU Systems Advisory: hxxps[://]www[.]wibu[.]com/support/security-advisories[.]html
- NIST NVD: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-41057