Skip to content
OpenAdvisories
Critical VDE-2020-031 6 CVEs

Endress+Hauser: Multiple products prone to WIBU CodeMeter vulnerabilities

Published Oct 27, 2020 · Updated May 14, 2025 · Revision 4

Vendor: Endress+Hauser Vendor: Wibu Product: CodeMeter Product: DeviceCare Product: Field Data Manager Product: FieldCare Product: FieldXpert Product: OPC UA Connectivity Server Product: SupplyCare Enterprise

Summary

For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html and the aforementioned CVE-IDs.

Details

Impact
For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html external link and the aforementioned CVE-IDs.

Mitigation
Most vulnerabilities have already been fixed in the current Code Meter versions 7.10. Use of this version requires additional mitigation measures to fix all CVEs. For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

Remedation
WIBU SYSTEMS has released a new Code Meter Runtime version 7.10a dated on 16.9.2020. All the known vulnerabilities are fixed with this version. The version is available at https://www.wibu.com/support

Vulnerabilities 6

  • Unscored —
    CVE-2020-14509

    Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mech…

  • Unscored —
    CVE-2020-14513

    CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted lice…

  • Unscored —
    CVE-2020-14515

    CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in…

  • Unscored —
    CVE-2020-14517

    Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90…

  • Unscored —
    CVE-2020-14519

    This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are …

  • Unscored —
    CVE-2020-16233

    An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back pack…

Revision history

  1. #4

    Fix: added distribution

  2. #3

    Fix: version range, remove Issuing authority

  3. #2

    Fix: added self-reference

  4. #1

    Initial revision.

References