Description
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read
license information belonging to another handle.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime | 9.00 – < 9.10, 8.00 – < 8.41a, 7.00, 6.00 | 9.10 |
Advisories 9
- VDE-2026-084 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware CERT@VDE · Nov 4, 2026
- VDE-2026-098 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools CERT@VDE · Nov 4, 2026
- SCA-2026-0011 Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products SICK PSIRT · Sep 30, 2026
- VDE-2026-091 TRUMPF: Multiple products affected by Wibu CodeMeter vulnerabilities CERT@VDE · Sep 15, 2026
- 3BHS973333 AC 800PEC, AC 800PEC ARM, AC 800PEC Tool, Control Terminal (xCT) and AC 800PEC Tool Cheetah Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 10, 2026
- 2NGA003144 ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime ABB PSIRT · Sep 9, 2026
- 3ADR011572 Automation Builder, Drive Application Builder, Virtual Drive, Virtual DrivePlus Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 3, 2026
- NCSC-2026-0333 Kwetsbaarheden verholpen in CodeMeter Runtime van Wibu-Systems NCSC-NL (Netherlands) · Aug 28, 2026
- WID-SEC-2026-3004 Wibu-Systems CodeMeter Runtime: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026