IM
IronMonkey Threat Research
‹ Back to ICS Advisories

Wibu-Systems CodeMeter Vulnerabilities (V1.1)

CRITICAL
CVSS 10.0
Date 2026-10-16T20:41:30+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification Page 1 of 4 ## Wibu-Systems CodeMeter Vulnerabilities (V1.1) 13 October 2020 (8 December 2020) # Overview Schneider Electric is aware of multiple vulnerabilities disclosed by Wibu-Systems in the CodeMeter licensing manager product which is used by some Schneider Electric and Eurotherm offers. Failure to apply the remediations provided below may risk various types of attack on CodeMeter, which could allow an attacker to alter and forge a license file, cause a denial-of-service condition, potentially attain remote code execution, read heap data, and prevent normal operation of third-party software dependent on the CodeMeter. December 2020 update: The CodeMeter V7.10a fix qualification is confirmed for EcoStruxure Machine SCADA Expert. # Affected Product and Version Affected Products Versions EcoStruxure Machine Expert (formerly known as SoMachine and SoMachine Motion) All versions E+PLC400 All versions E+PLC100 All versions E+PLC_Setup All versions EcoStruxure Machine SCADA Expert All versions # Vulnerability Details CVE ID: CVE-2020-14509 CVSS v3.0 Base Score 10.0 | Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Multiple memory corruption vulnerabilities exist where the packet parser mechanism of CodeMeter (All versions prior to 7.10a) does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities. CVE ID: CVE-2020-14513 CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields. 13-Oct-20 (8-Dec-20) Document Reference Number – SEVD-2020 -287-02 V1.1 Schneider Electric Security Notification Page 2 of 4 CVE ID: CVE-2020-14515 CVSS v3.0 Base Score 7.4 | High | CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

// Vulnerabilities (6)

CVE ID CVSS Score Severity Description
CVE-2020-14517 10.0 critical
CVE-2020-14517. Protocol encryption can be easily broken and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.
CVE-2020-14519 10.0 critical
CVE-2020-14519. This vulnerability could allow an attacker to use an internal API via a specifically crafted Java Script payload, which may allow alteration or creation of license files.
CVE-2020-16233 10.0 critical
CVE-2020-16233. An attacker could send a specially crafted packet that could have the server send back packets containing data from the heap.
CVE-2020-14509 10.0 critical
CVE-2020-14509. Multiple memory corruption vulnerabilities exist where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.
CVE-2020-14515 10.0 critical
CVE-2020-14515. There is an issue in the license-file signature checking mechanism, which could allow attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.
CVE-2020-14513 10.0 critical
CVE-2020-14513. CodeMeter and the software using it may crash while processing a specifically crafted license file due to unverified length fields.

// Affected Products (2)

Vendor Product Asset Type Purdue Level Firmware
Siemens Siemens SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server) historian
L3
--
Siemens Siemens SIMATIC WinCC OA hmi
L2
--

// Remediations (22)

Mitigation: Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
Patch: Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
Patch: Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
Mitigation: If CAPE 14 was initially installed using earlier material, see the recommendations from section Work
If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations
Mitigation: SICAM 230 To fix all issues for existing installations, update SICAM 230 to V8.00 or later version.
SICAM 230 To fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.
Patch: Update to V1.0 SP1 or later version
Update to V1.0 SP1 or later version
Patch: Update to V10.2 Upd1 or later version
Update to V10.2 Upd1 or later version
Mitigation: All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untruste
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
Patch: Update to V3.0 SP1 Update 1 or later version
Update to V3.0 SP1 Update 1 or later version
Patch: Update to V3.17 P007 or later version
Update to V3.17 P007 or later version
Mitigation: PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020
PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15): Update CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual. Contact PSS®CAPE Support at [email protected] if you need assistance with patching affected systems.
Mitigation: SIMATIC WinCC OA V3.17: Update to V3.17 P007 or later version to fix all issues. For patch levels <
SIMATIC WinCC OA V3.17: Update to V3.17 P007 or later version to fix all issues. For patch levels < P007, the following measures apply: CVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517. CVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.
Patch: CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they co
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
Mitigation: See also the recommendations from section Workarounds and Mitigations
See also the recommendations from section Workarounds and Mitigations
Mitigation: SIMIT Simulation Platform (Versions >= V10.0 and < V10.2 Upd1): To fix all issues for existing inst
SIMIT Simulation Platform (Versions >= V10.0 and < V10.2 Upd1): To fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.
Mitigation: For earlier versions see the recommendations from section Workarounds and Mitigations
For earlier versions see the recommendations from section Workarounds and Mitigations
Mitigation: Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all
Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues
Mitigation: SINEC INS (Versions < V1.0 SP1 only): Update CodeMeter Runtime to V7.10a: Download the package "Cod
SINEC INS (Versions < V1.0 SP1 only): Update CodeMeter Runtime to V7.10a: Download the package "CodeMeter User Runtime for Linux, version 7.10a, Driver-only" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command: sudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb
Patch: For more information on products dependent on the affected CodeMeter see the following vendor securi
For more information on products dependent on the affected CodeMeter see the following vendor security advisories:
Patch: For more information please see Wibu-Systems ' security advisories:
For more information please see Wibu-Systems ' security advisories:
Patch: Wibu-Systems recommends the following:
Wibu-Systems recommends the following:
Mitigation: SICAM 230 To fix all issues for existing installations, update SICAM 230 to V8.00 or later version.
SICAM 230 To fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.

// References