The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port.įor more information on this issue, please see Wibu security advisories: WIBU-210423-01, WIBU-210423-02įor more information on products dependent on the affected CodeMeter see the following vendor security advisories.Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users.Check if CmWAN is enabled and disable the feature if it is not needed. The CmWAN server is disabled by default.If it is not possible to disable the network server, using a host-based firewall to restrict access to the CmLAN port can reduce the risk.The network server is disabled by default. With binding to localhost an attack is no longer possible via remote network connection. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication.Wibu-Systems recommends the following mitigations:

Tenable, Inc., reported these vulnerabilities to CISA.

CRITICAL INFRASTRUCTURE SECTORS: Multiple.

A CVSS v3 base score of 9.1 has been calculated the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). 3.2.2 BUFFER OVER-READ CWE-126Īn attacker could send a specially crafted packet that could crash the server or direct the CodeMeter Runtime Network Server to send back packets containing data from the heap.ĬVE-2021-20093 has been assigned to this vulnerability.

A CVSS v3 base score of 7.5 has been calculated the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). 3.2 VULNERABILITY OVERVIEW 3.2.1 BUFFER OVER-READ CWE-126Īn attacker could send a specially crafted packet to the CodeMeter Runtime CmWAN server to cause a denial-of-service condition.ĬVE-2021-20094 has been assigned to this vulnerability.

This license manager is used in the products of many different vendors.

CodeMeter Runtime: All versions prior to v7.21a.

The following versions of CodeMeter Runtime, a license manager, are affected: Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe).

ATTENTION: Exploitable remotely/low attack complexity.

Codemeter runtime kit v5.00a