Full Report
WIBU Systems published information about two vulnerabilities and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section “Vulnerability Classification” below and got assigned the CVE IDs CVE-2021-20093 and CVE-2021-20094. Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Multiple Flaws in WIBU Systems CodeMeter Runtime (Siemens Integration)
## CVE Details
- **CVE ID:** CVE-2021-20093
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-125 (Out-of-bounds Read)
- **CVE ID:** CVE-2021-20094
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-476 (NULL Pointer Dereference)
## Affected Systems
- **Products:** WIBU Systems CodeMeter Runtime (integrated into several Siemens industrial and automation products for license management).
- **Versions:** All versions prior to CodeMeter Runtime v7.21a.
- **Configurations:** Systems where the CodeMeter Runtime network server is enabled and reachable over the network.
## Vulnerability Description
The vulnerabilities exist within the processing of network requests by the CodeMeter Runtime Server (`CodeMeter.exe`).
- **CVE-2021-20093:** An out-of-bounds read vulnerability that occurs when the server processes specially crafted packets. This allows an attacker to read data from the heap memory of the process.
- **CVE-2021-20094:** A NULL pointer dereference vulnerability. By sending a malicious packet, an attacker can trigger a crash of the `CodeMeter.exe` service.
## Exploitation
- **Status:** Not exploited in the wild (based on current report); no public PoC currently cited in context.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (CVE-2021-20093 allows reading potentially sensitive heap data).
- **Integrity:** None.
- **Availability:** High (CVE-2021-20094 allows for remote Denial of Service via service crash).
## Remediation
### Patches
- **WIBU Systems:** Update to CodeMeter Runtime v7.21a or later.
- **Siemens Products:** Siemens has released specific updates for affected product lines. Users should consult the Siemens ProductCERT portal for version-specific updates for products such as TIA Portal, SIMATIC, and others utilizing CodeMeter.
### Workarounds
- **Disable Network Server:** If the CodeMeter network server functionality is not required, disable it to close the remote attack vector.
- **Firewall Restrictions:** Restrict access to the CodeMeter port (default TCP 22350) to trusted internal hosts only.
- **Run as Local Service:** Configure the service to only listen on `127.0.0.1` if network-based licensing is not utilized.
## Detection
- **Indicators of Compromise:** Unexpected restarts of the `CodeMeter.exe` process; unusual network traffic spikes on TCP port 22350.
- **Detection Methods:** Monitor system logs for service crashes related to `CodeMeter.exe`. Use vulnerability scanners to identify outdated versions of the CodeMeter Runtime library (WibuCm64.dll).
## References
- **WIBU Systems Advisory:** hxxps[://]www[.]wibu[.]com/support/advisories.html
- **Siemens ProductCERT:** hxxps[://]cert-portal[.]siemens[.]com/productcert/txt/ssa-675303[.]txt
- **NVD CVE-2021-20093:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-20093
- **NVD CVE-2021-20094:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-20094