Description
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-
origin restrictions. Commands intended only for local or same-network clients can therefore be executed by
arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values
in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin
takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime | 9.00 – < 9.10, 8.00 – < 8.41a, 7.x, 6.x | 9.10 |
Advisories 9
- VDE-2026-084 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware CERT@VDE · Nov 4, 2026
- VDE-2026-098 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools CERT@VDE · Nov 4, 2026
- SCA-2026-0011 Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products SICK PSIRT · Sep 30, 2026
- VDE-2026-091 TRUMPF: Multiple products affected by Wibu CodeMeter vulnerabilities CERT@VDE · Sep 15, 2026
- 3BHS973333 AC 800PEC, AC 800PEC ARM, AC 800PEC Tool, Control Terminal (xCT) and AC 800PEC Tool Cheetah Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 10, 2026
- 2NGA003144 ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime ABB PSIRT · Sep 9, 2026
- 3ADR011572 Automation Builder, Drive Application Builder, Virtual Drive, Virtual DrivePlus Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 3, 2026
- NCSC-2026-0333 Kwetsbaarheden verholpen in CodeMeter Runtime van Wibu-Systems NCSC-NL (Netherlands) · Aug 28, 2026
- WID-SEC-2026-3004 Wibu-Systems CodeMeter Runtime: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026