Skip to content
OpenAdvisories
High VDE-2026-084 4 CVEs

Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware

Published Nov 4, 2026 · Updated Nov 4, 2026

Vendor: Phoenix Contact Vendor: Wibu Product: AXC F 1152 Product: AXC F 1252 Product: AXC F 2000 EA Product: AXC F 2152 Product: AXC F 3152 Product: BPC 9102S Product: BPC 9202S Product: Catan C1 Product: codemeter-runtime Product: RFC 4072R Product: RFC 4072S Product: VL3 UPC 2440 EDGE Product: VPLCNEXT CONTROL 1000 Product: VPLCNEXT CONTROL 2000 Product: VPLCNEXT CONTROL 3000 Product: VPLCNEXT CONTROL 500

Summary

This advisory addresses security vulnerabilities in Phoenix Contact products with an integrated CodeMeter Runtime, like PLCnext devices and Virtual Controls. These security vulnerabilities only may occur with versions <8.41a of the integrated software CodeMeter Runtime from Wibu-Systems. Please see listed products to determine which devices and firmware versions are affected.

Details

Impact
The reported vulnerabilities allow unauthenticated attackers to read and overwrite sensitive configuration data and to crash CodeMeter Runtime which has only an impact on the licensing infrastructure. Licenses then are not accessible anymore. These security vulnerabilities may occur on PLCnext devices or Virtual Controls with an integrated CodeMeter Runtime (see affected products).

Remediation
Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.

Mitigation
For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:

On PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.

Vulnerabilities 4

  • High 8.6
    CVE-2026-81573

    Improper Access Control in Local-Only Configuration Commands

    If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers.…

    Wibu codemeter-runtime
  • High 8.2
    CVE-2026-81574

    Format String Vulnerability in Logger

    In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information su…

    Wibu codemeter-runtime
  • High 7.7
    CVE-2026-81576

    Improper Authentication of Session Handles

    If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read …

    Wibu codemeter-runtime
  • High 7.5
    CVE-2026-81575

    Missing Sanity Checks for Buffer Lengths

    If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segme…

    Wibu codemeter-runtime

Revision history

  1. #1.0.0

    Initial

References