WAGO: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products

Impact
WAGO controllers and IO-Devices are not affected by WIBU-SYSTEMS Codemeter vulnerabilities. However, due to compatibility reasons to the CODESYS Store, the e!COCKPIT and WAGO-I/O-Pro engineering software are bundled with a WIBU-SYSTEMS Codemeter installation.

Mitigation
Disable using a SOCKS5 proxy:

The proxy environment variables HTTP_PROXY, HTTPS_PROXY and ALL_PROXY must not be set to socks5h://
Ensure that CodeMeter is not defined to use the SOCKS5 proxy. The variable ProxyServer must not be start with socks5h://.

On Windows, the definition of that variable is in the registry (regedit) under HKLM/SOFTWARE/WIBU-SYSTEMS/CodeMeter/Server/CurrentVersion
On Mac, the definition of that variable is in the file /Library/Preferences/com.wibu.CodeMeter.Server.ini
On Linux, the definition of that variable is in the file /etc/wibu/CodeMeter/Server.ini
On Solaris, the definition of that variable is in the file/etc/opt/CodeMeter/Server.ini

For further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisories WIBU-231024-01 and WIBU-231017-01 at Website https://www.wibu.com/support/security-advisories.html.

Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version.