Skip to content
OpenAdvisories
Critical SSA-455843 6 CVEs

SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products

Published Sep 8, 2020 · Updated Feb 17, 2022 · Revision 8

Vendor: Siemens Product: PSS CAPE Protection Simulation Platform Product: SICAM 230 Product: SIMATIC Information Server 2019 Product: SIMATIC PCS neo Product: SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server) Product: SIMATIC WinCC OA Product: SIMIT Simulation Platform Product: SINEC INS Product: SINEMA Remote Connect

Summary

CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management.

The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 6

  • Unscored —
    CVE-2020-14509

    Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mech…

  • Unscored —
    CVE-2020-14513

    CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted lice…

  • Unscored —
    CVE-2020-14515

    CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in…

  • Unscored —
    CVE-2020-14517

    Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90…

  • Unscored —
    CVE-2020-14519

    This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are …

  • Unscored —
    CVE-2020-16233

    An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back pack…

Revision history

  1. #8

    Moved products from Siemens Energy to separate advisory SSA-455844

  2. #7

    Updated solution for PSS CAPE and SIMIT

  3. #6

    Updated solution for SINEC INS and SINEMA Remote Connect

  4. #5

    Updated solution for SPPA S3000 (with fixes for the open CVEs)

  5. #4

    Updated solutions for PCS neo and SPPA T3000 (with fixes for the open CVEs)

  6. #3

    Added SICAM 230

  7. #2

    Added PSS CAPE Protection Simulation Platform; added solution by software update for SIMATIC WinCC OA; added solution by installation of latest CodeMeter Runtime version for SIMIT, SINEC INS, and PSS CAPE

  8. #1

    Publication Date

References