Weidmueller: u-create studio < 1.20.2 affected by WIBU-SYSTEMS CodeMeter vulnerabilities

Impact
The stated Weidmüller product is supplied with the WIBU-SYSTEMS CodeMeter Runtime software in version 6.81, which contains the following vulnerabilities:

| WIBU Security Advisory | CVE Number | Score | Description |
|------------------------|--------------------|-------|-------------|
| WIBU-200521-01 | CVE-2020-14513 | 7.5 | Not affected (Fixed in 6.81. Weidmüller uses 6.81 at least.) |
| WIBU-200521-02 | CVE-2020-14519 | 8.1 | CodeMeter Runtime WebSockets API: Missing Origin Validation |
| WIBU-200521-03 | CVE-2020-14509 | 10.0 | CodeMeter Runtime DoS due to Buffer Access with Incorrect Length Value |
| WIBU-200521-04 | CVE-2020-14517 | 9.4 | CodeMeter Runtime API: Inadequate Encryption Strength and Authentication |
| WIBU-200521-05 | CVE-2020-16233 | 7.5 | CodeMeter Runtime API: Heap Leak |
| WIBU-200521-06 | CVE-2020-14515 | 7.4 | Improper Signature Verification of CmActLicense update files for CmActLicense Firm Code |

Runtime software for Weidmüller controllers is not affected because the critical interfaces are disabled.

Mitigation
Use general security best practices to protect systems from local and network attacks.
For versions prior to 7.10a run CodeMeter Runtime as client only and use localhost as binding for the
CodeMeter communication. With binding to localhost an attack is no longer possible via remote network
connection. This is the default configuration.
If CodeMeter Runtime is required to run as network server use the CodeMeter License Access
Permissions feature to restrict the usage of CodeMeter API.

For further impact information and risk mitigation, please refer to the official WIBU-SYSTEMS Advisory Website at https://www.wibu.com/support/security-advisories.html

Remediation
- For an installed u-create studio: Update to the current version 7.10a or newer of the CodeMeter Runtime, available via the manufacturer's website.
- For a new installation of u-create studio: First install u-create studio, then update to the current version 7.10a or newer of the CodeMeter Runtime available via the manufacturer's website external link.
Note: An update of the CodeMeter Runtime before installation of u-create studio will cause errors during installation of u-create studio.