| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2026-81572 | 8.2 | high |
CVE-2026-81572. cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
|
| CVE-2026-81576 | 7.7 | high |
CVE-2026-81576. If configured as a server, CodeMeter Runtime issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
CodeMeter Runtime is only affected by the vulnerabilities listed below if it is configured as a server. This is not the default. To verify the setting, check the profiling value IsNetworkServer:
- IsNetworkServer=1: configured as a server (affected).
- IsNetworkServer=0: not configured as a server
|
| CVE-2026-81574 | 8.2 | high |
CVE-2026-81574. The logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.
CodeMeter Runtime is only affected by the vulnerabilities listed below if it is configured as a server. This is not the default. To verify the setting, check the profiling value IsNetworkServer:
- IsNetworkServer=1: configured as a server (affected).
- IsNetworkServer=0: not configured as a server
|
| CVE-2026-81575 | 7.5 | high |
CVE-2026-81575. If configured as a server, CodeMeter Runtime accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
CodeMeter Runtime is only affected by the vulnerabilities listed below if it is configured as a server. This is not the default. To verify the setting, check the profiling value IsNetworkServer:
- IsNetworkServer=1: configured as a server (affected).
- IsNetworkServer=0: not configured as a server.
|
| CVE-2026-81573 | 8.6 | high |
CVE-2026-81573. If CodeMeter Runtime is configured as a server, the configuration command handler does not enforce networkorigin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
CodeMeter Runtime is only affected by the vulnerabilities listed below if it is configured as a server. This is not the default. To verify the setting, check the profiling value IsNetworkServer:
- IsNetworkServer=1: configured as a server (affected).
- IsNetworkServer=0: not configured as a server.
|
| Vendor | Product | Asset Type | Purdue Level | Firmware |
|---|---|---|---|---|
| ABB | Unknown | rtu |
L1
|
-- |
| ABB | Unknown | rtu |
L1
|
-- |