Skip to content
OpenAdvisories
High SSA-580693 1 CVE

SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products

Published Nov 9, 2021 · Updated Aug 9, 2022 · Revision 4

Vendor: Siemens Product: PSS(R)CAPE Product: PSS(R)E V34 Product: PSS(R)E V35 Product: PSS(R)ODMS V12 Product: SICAM 230 Product: SIMATIC Information Server Product: SIMATIC PCS neo Product: SIMATIC Process Historian (incl. Process Historian OPC UA Server) Product: SIMATIC WinCC OA V3.17 Product: SIMATIC WinCC OA V3.18 Product: SIMIT Simulation Platform

Summary

WIBU Systems published information about a denial-of-service
vulnerability and an associated fix release version of CodeMeter
Runtime, a product provided by WIBU Systems and used in several
Siemens products for license management. The vulnerability is
described in the section "Vulnerability Classification" below and got
assigned the CVE ID CVE-2021-41057. Successful exploitation of this
vulnerability could allow an attacker to crash the CodeMeter Runtime
Server (i.e., CodeMeter.exe), which could cause a denial-of-service
condition for the affected Siemens product. Siemens has released
updates for the affected products and recommends to update to the
latest versions.

Vulnerabilities 1

  • Unscored —
    CVE-2021-41057

    In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file witho…

Revision history

  1. #4

    Added fix for SIMIT Simulation Platform

  2. #3

    Added solution for SIMATIC PCS neo, Information Server and Process Historian

  3. #2

    Added solution for SIMATIC WinCC OA V3.18 and V3.17

  4. #1

    Publication Date

References