Skip to content
OpenAdvisories
Critical VDE-2019-003 3 CVEs

PHOENIX CONTACT: Multiple Vulnerabilities in MEVIEW3

Published Mar 5, 2019 · Updated May 14, 2025 · Revision 3

Vendor: Phoenix Contact Product: MEVIEW3

Summary

Multiple vulnerabilities for MEVIEW3 have been identified in PHOENIX CONTACT MEVIEW3, versions below 3.14.25 and 3.15.18

Details

Impact
**Remote Code Execution Vulnerability:**
WIBU-SYSTEMS WibuKey network server management remote code execution vulnerability. The vulnerability affects all operating systems...

**Privilege Escalation Vulnerability:**
WIBU-SYSTEMS WibuKey.sys pool has a corruption privilege escalation vulnerability. The vulnerability affects Windows systems...

Mitigation
1. Dongle based licensing:
Update WibuKey Runtime to version 6.50. See: [WIBU-SYSTEMS Download Page](https://www.wibu.com/support/user/downloads-user-software.html)

2. Hardwarecode-based licensing:
Removing the WibuKey application.

For further information please refer to:
[WIBU-SYSTEMS Support Documentation](https://www.wibu.com/de/support/anwendersoftware/anwendersoftware/file/download/5638.html)

Remediation
WibuKey Runtime Version 6.50 will be integrated in the next version MEVIEW3 (3.14.25 & 3.15.18).

Vulnerabilities 3

  • Critical 10.0
    CVE-2018-3991 EPSS 34%

    An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, v…

  • Critical 9.3
    CVE-2018-3990

    An exploitable pool corruption vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuK…

  • Medium 4.3
    CVE-2018-3989

    An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYST…

Revision history

  1. #3

    Fix: added distribution

  2. #2

    Fix: correct certvde domain, added alias, added self-reference

  3. #1

    Initial revision.

References