Skip to content
OpenAdvisories
Critical VDE-2022-019 8 CVEs

Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components

Published Jun 2, 2022 · Updated Jun 2, 2022

Vendor: Endress+Hauser Product: DeviceCare Product: Field Data Manager Product: Field Xpert Product: FieldCare Product: Proline Promag W 800 OPC/UA Connectivity Server Product: SupplyCare Enterprise

Summary

For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

Details

Mitigation
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.
The version is available at https://www.wibu.com/support.
For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.

Remediation
Update the software application of the affected products:

| # | Product Name | Fixed Version |
|----------------------------------|-----------------------------------------------|-------------------|
| SCE30B | | |
| SCE31B | SupplyCare Enterprise | >= 3.5.1 |
| SCE32B | | |
| SFE100 | DeviceCare | >= 1.07.07 |
| SFE500 | FieldCare | >= 2.17.00 |
| SMT50 | | |
| SMT70 | Field Xpert | >= 1.06.00 |
| SMT77 | | |
| MS20 | | |
| MS21 | Field Data Manager | >= 1.6.3 |
| Freeware for the | | |
| Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 |
| via Endress+Hauser Download Portal | | |

Vulnerabilities 8

  • Medium 6.5
    CVE-2021-41182 Public exploit EPSS 39%

    XSS in the `altField` option of the Datepicker widget

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value…

    jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  • Medium 6.5
    CVE-2021-41183

    XSS in `*Text` options of the Datepicker widget

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values pas…

    jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  • Medium 6.5
    CVE-2021-41184 Public exploit EPSS 41%

    XSS in the `of` option of the `.position()` util

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…

    jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems
  • Unscored —
    CVE-2020-8286

    curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…

    curl curl curl Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-20093 EPSS 33%

    A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker …

  • Unscored —
    CVE-2021-20094

    A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker…

  • Unscored —
    CVE-2021-22901 EPSS 64%

    curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used whe…

    curl curl Azure Linux Alpine
  • Unscored —
    CVE-2021-41057

    In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file witho…

Revision history

  1. #1.0.0

    Initial revision.

References