Skip to content
OpenAdvisories
High SCA-2026-0011 5 CVEs

Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products

Published Sep 4, 2026 · Updated Sep 30, 2026 · Revision 2

Vendor: SICK Product: APU0G00 Product: APU0G00 firmware Product: APU0G03 Product: APU0G03 firmware Product: APU0G50 Product: APU0G50 firmware Product: APU3F00 Product: APU3F00 firmware Product: APU4600 Product: APU4600 firmware Product: APU8G00 Product: APU8G00 firmware Product: APU8G20 Product: APU8G20 firmware Product: CODE-LOC Product: LiDAR-LOC Product: PLB Product: PLB firmware Product: Safety Designer Product: Sentio Compose Product: Sentio Creator Product: SIM1200-2A1A130 LiDAR-LOC Product: SIM1200-2A1A130 LiDAR-LOC firmware Product: Stream Editor

Summary

Several vulnerabilities in the Wibu Systems CodeMeter Runtime affect the SICK products Sentio Creator, Sentio Compose, Safety Designer, Stream Editor, CODE-LOC, LiDAR-LOC, PLB, SIM1200-2A1A130 LiDAR-LOC and multiple SICK Industrial PCs (APU0G00, APU0G50, APU0G03, APU3F00, APU4600, APU8G00 and APU8G20), which ship with CodeMeter Runtime as part of their preinstalled image. For Sentio Compose, Safety Designer, Stream Editor and PLB, only CVE-2026-81572 is relevant. Vulnerabilities requiring the CodeMeter Runtime to be configured as a server are not applicable to default Sentio Compose, Safety Designer, Stream Editor and PLB installations, as the runtime is shipped with the Network Server and CmWAN Server functionalities disabled. Customers who have modified the default configuration and enabled CodeMeter server functionality should review the remaining vulnerabilities for potential impact. The vulnerabilities could potentially affect the integrity, confidentiality, and availability of the affected products.

Vulnerabilities 5

  • High 8.6
    CVE-2026-81573

    Improper Access Control in Local-Only Configuration Commands

    If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers.…

    Wibu codemeter-runtime
  • High 8.2
    CVE-2026-81574

    Format String Vulnerability in Logger

    In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information su…

    Wibu codemeter-runtime
  • High 7.8
    CVE-2026-81572

    Local Privilege Escalation in CodeMeter Runtime on Windows

    In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such…

    Wibu codemeter-runtime
  • High 7.7
    CVE-2026-81576

    Improper Authentication of Session Handles

    If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read …

    Wibu codemeter-runtime
  • High 7.5
    CVE-2026-81575

    Missing Sanity Checks for Buffer Lengths

    If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segme…

    Wibu codemeter-runtime

Revision history

  1. #2

    Added products LiDAR-LOC, CODE-LOC, and SIM1200-2A1A130 LiDAR-LOC. Updated the vendor fix information for Sentio Creator.

  2. #1

    Initial version

References