Summary
WIBU publicly released an advisory for the WIBU product “CodeMeter Runtime Network Server”. The advisory discloses a buffer over-read vulnerability that was found in the WIBU product “CodeMeter Runtime Network Server”.
By default the network server functionality is disabled, however the SICK product “FieldEcho” may be vulnerable, if customers enables this.
SICK has released a new FieldEcho version and recommends updating to the newest version.
Since version 1.5.2 of SICK “FieldEcho”, customer can choose to use their own license server. If so, SICK advises to take action in accordance with the official WIBU Security Advisory.
Vulnerabilities 1
-
Unscored —CVE-2021-20093 EPSS 33%
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker …
Revision history
-
#3
Updated Advisory: URL for SICK Operating Guidelines has been updated
-
#2
Updated Advisory (only visual changes)
-
#1
Initial release
References
-
SICK PSIRT Security Advisories
https://sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
http://ics-cert.us-cert.gov/content/recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1