Summary
This advisory addresses multiple security vulnerabilities in Phoenix Contact products using the software CodeMeter Runtime like licensed desktop software tools. These security vulnerabilities only may occur with CodeMeter Runtime 8.x versions <V8.41a and CodeMeter Runtime 9.x versions <9.10 from Wibu-Systems.
Details
Impact
The reported vulnerabilities allow unauthenticated attackers to delete arbitrary files, to read and overwrite sensitive configuration data and to crash Codemeter Runtime. These security vulnerabilities may occur on systems with operating systems Windows, Linux and Mac with installed Phoenix Contact software tools (see affected products).
Remediation
Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.
| Product Name | Planned Fixed Version |
|---|---|
| Activation Wizard | 1.8.2 |
| PLCnext Engineer | 2026.0.5 LTS |
| PLCnext Engineer EDU LIC | 2026.0.5 LTS |
| FL Network Manager | 10.0 |
| CLIPX ENGINEER ASSEMBLE | 1.3.1 |
| MLnext Execution | 2026.12 |
| MLnext Creation | 2026.12 |
| IO-Link ENGINEER | 6.0.1.11090 |
| MARKING system | 1.3 |
Mitigation
Phoenix Contact strongly recommends affected users to upgrade to CodeMeter Runtime >=V8.41a or >=V9.10, which fixes these vulnerabilities. WIBU-SYSTEMS has already published CodeMeter Runtime updates on their homepage. Since the updated versions of Codemeter Runtime have not yet been incorporated into Phoenix Contact software tools, we strongly recommend to download and install the updated CodeMeter Runtime version e.g. for Windows directly from the WIBU-SYSTEMS homepage.
If you enabled the network server functionality on a Windows, Linux or Mac-system at some point but no longer need it, disable it.
If you are using CodeMeter Runtime 9.00 or newer, you can use cmu --disable-network-server.
If you are using older versions of CodeMeter Runtime, do the following:
On Windows:
+ Open the Registry Editor.
+ Navigate to "computer\HKEY_LOCAL_MACHINE\SOFTWARE\WIBU-SYSTEMS\CodeMeter\Server\CurrentVersion\".
+ Then change the value of NetworkServer from 1 to 0.
+ Restart CodeMeter.
On Linux and Mac:
+ Stop CodeMeter.
+ Edit the file under "/etc/wibu/CodeMeter/Server.ini":
Under [General], change the value IsNetworkServer from 1 to 0.
• Then start CodeMeter again.
Vulnerabilities 5
-
High 8.6
Improper Access Control in Local-Only Configuration Commands
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers.…
-
High 8.2
Format String Vulnerability in Logger
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information su…
-
High 7.8
Local Privilege Escalation in CodeMeter Runtime on Windows
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such…
-
High 7.7
Improper Authentication of Session Handles
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read …
-
High 7.5
Missing Sanity Checks for Buffer Lengths
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segme…
Revision history
-
#1.0.0
Initial
References
-
PCSA-2026-00013
https://phoenixcontact.com/psirt
-
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact
-
VDE-2026-098: Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools - HTML
https://certvde.com/en/advisories/vde-2026-098