Skip to content
OpenAdvisories
Critical ICSA-23-320-03 3 CVEs

Siemens Desigo CC product family

Published Nov 14, 2023 · Updated Aug 13, 2024 · Revision 2

Vendor: Siemens Product: Desigo CC family V5.0 Product: Desigo CC family V5.1 Product: Desigo CC family V6 Product: Desigo CC family V7 Product: SENTRON powermanager

Summary

Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime.
Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition.
While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935.

Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-3935

    Wibu: Buffer Overflow in CodeMeter Runtime

    A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

    Wibu codemeter-runtime
  • Unscored —
    CVE-2021-20093 EPSS 33%

    A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker …

  • Unscored —
    CVE-2021-20094

    A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker…

Revision history

  1. #2

    Added SENTRON powermanager

  2. #1

    Publication Date

References