Summary
A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.
Details
Impact
The stated TRUMPF CAD/CAM products are supplied with the WIBU CodeMeter Runtime Software in versions that are known to contain a number of vulnerabilities. We can not confirm at this time whether the use of vulnerable CodeMeter exposes our products to the risks described in the CVEs mentioned above. Nevertheless, we are working to replace the vulnerable versions of CodeMeter with available fixed versions.
Mitigation
- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly.
- Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.
Vulnerabilities 6
-
Unscored —
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mech…
-
Unscored —
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted lice…
-
Unscored —
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in…
-
Unscored —
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90…
-
Unscored —
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are …
-
Unscored —
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back pack…
Revision history
-
#2
Fix: reference category, added distribution
-
#1
Initial revision.
References
-
CERT@VDE Security Advisories for TRUMPF Werkzeugmaschinen SE + Co. KG
https://certvde.com/en/advisories/vendor/trumpf/
-
VDE-2020-039: TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2020-039/