{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination.", "urls": [ "https://certvde.com" ] }, { "organization": "Wibu-Systems", "summary": "Reporting.", "urls": [ "https://www.wibu.com/support/security-advisories.html" ] }, { "organization": "Vector Informatik GmbH, Andrew Teylu", "summary": "Reporting." }, { "organization": "Shelltrail AB, Andreas Vikerup", "summary": "Reporting", "urls": [ "https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "High" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "general", "text": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [Application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).", "title": "General Recommendation" }, { "category": "description", "text": "The reported vulnerabilities allow unauthenticated attackers to delete arbitrary files, to read and overwrite sensitive configuration data and to crash Codemeter Runtime. These security vulnerabilities may occur on systems with operating systems Windows, Linux and Mac with installed Phoenix Contact software tools (see affected products).", "title": "Impact" }, { "category": "description", "text": "Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.\n\n| Product Name | Planned Fixed Version |\n|---|---|\n| Activation Wizard | 1.8.2 |\n| PLCnext Engineer | 2026.0.5 LTS |\n| PLCnext Engineer EDU LIC | 2026.0.5 LTS |\n| FL Network Manager | 10.0 |\n| CLIPX ENGINEER ASSEMBLE | 1.3.1 |\n| MLnext Execution | 2026.12 |\n| MLnext Creation | 2026.12 |\n| IO-Link ENGINEER | 6.0.1.11090 |\n| MARKING system | 1.3 |", "title": "Remediation" }, { "category": "summary", "text": "This advisory addresses multiple security vulnerabilities in Phoenix Contact products using the software CodeMeter Runtime like licensed desktop software tools. These security vulnerabilities only may occur with CodeMeter Runtime 8.x versions =V8.41a or >=V9.10, which fixes these vulnerabilities. WIBU-SYSTEMS has already published CodeMeter Runtime updates on their homepage. Since the updated versions of Codemeter Runtime have not yet been incorporated into Phoenix Contact software tools, we strongly recommend to download and install the updated CodeMeter Runtime version e.g. for Windows directly from the WIBU-SYSTEMS homepage.\n\nIf you enabled the network server functionality on a Windows, Linux or Mac-system at some point but no longer need it, disable it.\n\nIf you are using CodeMeter Runtime 9.00 or newer, you can use cmu --disable-network-server.\n\nIf you are using older versions of CodeMeter Runtime, do the following:\n\nOn Windows:\n+\tOpen the Registry Editor. \n+\tNavigate to \"computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\WIBU-SYSTEMS\\CodeMeter\\Server\\CurrentVersion\\\".\n+\tThen change the value of NetworkServer from 1 to 0. \n+\tRestart CodeMeter.\n\nOn Linux and Mac:\n+\tStop CodeMeter.\n+\tEdit the file under \"/etc/wibu/CodeMeter/Server.ini\":\nUnder [General], change the value IsNetworkServer from 1 to 0. \n•\tThen start CodeMeter again.\n", "title": "Mitigation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@phoenixcontact.com", "name": "Phoenix Contact GmbH & Co. KG", "namespace": "https://phoenixcontact.com/psirt" }, "references": [ { "category": "external", "summary": "PCSA-2026-00013", "url": "https://phoenixcontact.com/psirt" }, { "category": "external", "summary": "Phoenix Contact advisory overview at CERT@VDE", "url": "https://certvde.com/de/advisories/vendor/phoenixcontact" }, { "category": "self", "summary": "VDE-2026-098: Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools - HTML", "url": "https://certvde.com/en/advisories/vde-2026-098" }, { "category": "self", "summary": "VDE-2026-098: Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools - CSAF", "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-098.json" } ], "source_lang": "en", "title": "Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools", "tracking": { "aliases": [ "VDE-2026-098", "PCSA-2026-00013" ], "current_release_date": "2026-11-04T11:00:00.000Z", "generator": { "date": "2026-11-03T17:04:03.897Z", "engine": { "name": "Secvisogram", "version": "2.6.16" } }, "id": "VDE-2026-098", "initial_release_date": "2026-11-04T11:00:00.000Z", "revision_history": [ { "date": "2026-11-04T11:00:00.000Z", "number": "1.0.0", "summary": "Initial" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.8.2", "product": { "name": "Activation Wizard <1.8.2", "product_id": "CSAFPID-51001", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:activation_wizard:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.8.2", "product": { "name": "Activation Wizard 1.8.2", "product_id": "CSAFPID-52001", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:activation_wizard:1.8.2:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<2026.0.5 LTS", "product": { "name": "PLCnext Engineer <2026.0.5 LTS", "product_id": "CSAFPID-51002", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:plcnext_engineer:*:*:*:*:*:*:*:*", "model_numbers": [ "1046008" ] } } }, { "category": "product_version", "name": "2026.0.5", "product": { "name": "PLCnext Engineer 2026.0.5 LTS", "product_id": "CSAFPID-52002", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:plcnext_engineer:2026.0.5_lts:*:*:*:*:*:*:*", "model_numbers": [ "1046008" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<2026.0.5 LTS", "product": { "name": "PLCnext Engineer EDU LIC <2026.0.5 LTS", "product_id": "CSAFPID-51003", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:plcnext_engineer_edu_lic:*:*:*:*:*:*:*:*", "model_numbers": [ "1165891" ] } } }, { "category": "product_version", "name": "2026.0.5", "product": { "name": "PLCnext Engineer EDU LIC 2026.0.5 LTS", "product_id": "CSAFPID-52003", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:plcnext_engineer_edu_lic:2026.0.5_lts:*:*:*:*:*:*:*", "model_numbers": [ "1165891" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0|<10.0", "product": { "name": "FL Network Manager <10.0", "product_id": "CSAFPID-51004", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:fl_network_manager:*:*:*:*:*:*:*:*", "model_numbers": [ "2702889" ] } } }, { "category": "product_version", "name": "10.0", "product": { "name": "FL Network Manager 10.0", "product_id": "CSAFPID-52004", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:fl_network_manager:10.0:*:*:*:*:*:*:*", "model_numbers": [ "2702889" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.3.3", "product": { "name": "MTP DESIGNER <1.3.3", "product_id": "CSAFPID-51005", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:mtp_designer:*:*:*:*:*:*:*:*", "model_numbers": [ "1636198" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.3.3", "product": { "name": "MTP DESIGNER TRIAL <1.3.3", "product_id": "CSAFPID-51006", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:mtp_designer_trial:*:*:*:*:*:*:*:*", "model_numbers": [ "1636200" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.3.1", "product": { "name": "CLIPX ENGINEER ASSEMBLE <1.3.1", "product_id": "CSAFPID-51007", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:clipx_engineer_assemble:*:*:*:*:*:*:*:*", "model_numbers": [ "1662166" ] } } }, { "category": "product_version", "name": "1.3.1", "product": { "name": "CLIPX ENGINEER ASSEMBLE 1.3.1", "product_id": "CSAFPID-52007", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:clipx_engineer_assemble:1.3.1:*:*:*:*:*:*:*", "model_numbers": [ "1662166" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<2026.12", "product": { "name": "MLnext Execution <2026.12", "product_id": "CSAFPID-51008", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:mlnext_execution:*:*:*:*:*:*:*:*", "model_numbers": [ "1391115" ] } } }, { "category": "product_version", "name": "2026.12", "product": { "name": "MLnext Execution 2026.12", "product_id": "CSAFPID-52008", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:mlnext_execution:2026.12:*:*:*:*:*:*:*", "model_numbers": [ "1391115" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<2026.12", "product": { "name": "MLnext Creation <2026.12", "product_id": "CSAFPID-51009", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:mlnext_creation:*:*:*:*:*:*:*:*", "model_numbers": [ "1697763" ] } } }, { "category": "product_version", "name": "2026.12", "product": { "name": "MLnext Creation 2026.12", "product_id": "CSAFPID-52009", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:mlnext_creation:2026.12:*:*:*:*:*:*:*", "model_numbers": [ "1697763" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<6.0.1.11090", "product": { "name": "IO-Link ENGINEER <6.0.1.11090", "product_id": "CSAFPID-51010", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:io-link_engineer:*:*:*:*:*:*:*:*", "model_numbers": [ "1534453" ] } } }, { "category": "product_version", "name": "6.0.1.11090", "product": { "name": "IO-Link ENGINEER 6.0.1.11090", "product_id": "CSAFPID-52010", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:io-link_engineer:6.0.1.11090:*:*:*:*:*:*:*", "model_numbers": [ "1534453" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.3", "product": { "name": "MARKING system <1.3", "product_id": "CSAFPID-51011", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:marking_system:*:*:*:*:*:*:*:*", "model_numbers": [ "1669297" ] } } }, { "category": "product_version", "name": "1.3", "product": { "name": "MARKING system 1.3", "product_id": "CSAFPID-52011", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:marking_system:1.3:*:*:*:*:*:*:*", "model_numbers": [ "1669297" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.7.1", "product": { "name": "EV Charging Suite 5 Charge Points (EV-CC-S-SUITE-CP5) <1.7.1", "product_id": "CSAFPID-51012", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:ev_cc_s_suite_cp5:*:*:*:*:*:*:*:*", "model_numbers": [ "1153509" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.7.1", "product": { "name": "EV Charging Suite 20 Charge Points (EV-CC-S-SUITE-CP20) <1.7.1", "product_id": "CSAFPID-51013", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:ev_cc_s_suite_cp20:*:*:*:*:*:*:*:*", "model_numbers": [ "1153508" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.7.1", "product": { "name": "EV Charging Suite 50 Charge Points (EV-CC-S-SUITE-OEM) <1.7.1", "product_id": "CSAFPID-51014", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:ev_cc_s_suite_oem:*:*:*:*:*:*:*:*", "model_numbers": [ "1128335" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.7.1", "product": { "name": "EV Charging Suite 10 Charge Points (EV-CC-S-SUITE-CP10) =0.0.0|<1.7.1", "product": { "name": "EV Charging Suite 30 Charge Points (EV-CC-S-SUITE-CP30) <1.7.1", "product_id": "CSAFPID-51016", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:ev_cc_s_suite_cp30:*:*:*:*:*:*:*:*", "model_numbers": [ "1086921" ] } } }, { "category": "product_version_range", "name": "vers:semver/>=0.0.0|<1.7.1", "product": { "name": "EV Charging Suite 50 Charge Points (EV-CC-S-SUITE-CP50) =0.0.0|<1.7.0.169", "product": { "name": "IOL Conf <1.7.0.169", "product_id": "CSAFPID-51018", "product_identification_helper": { "cpe": "cpe:2.3:a:phoenix_contact:iol_conf:*:*:*:*:*:*:*:*", "model_numbers": [ "1083065" ] } } } ], "category": "product_family", "name": "CodeMeter Runtime licensed software components" } ], "category": "vendor", "name": "Phoenix Contact" } ], "product_groups": [ { "group_id": "CSAFGID-1001", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011" ], "summary": "Affected Products." }, { "group_id": "CSAFGID-1002", "product_ids": [ "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ], "summary": "Affected Products (No fix planned)." }, { "group_id": "CSAFGID-2001", "product_ids": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52007", "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011" ], "summary": "Planned Fixed Products in Q4/2026." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-81573", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51012", "CSAFPID-51018", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51008" ] }, "remediations": [ { "category": "none_available", "details": "Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.", "group_ids": [ "CSAFGID-1001" ], "restart_required": { "category": "system" }, "url": "https://www.phoenixcontact.com" }, { "category": "mitigation", "details": "Download and update to CodeMeter Runtime >=V8.41a or >=V9.10 which fixes this vulnerability. Fixed CodeMeter Runtime versions are available on the Wibu-Systems webpage wibu.com.", "group_ids": [ "CSAFGID-1001", "CSAFGID-1002" ], "restart_required": { "category": "system" }, "url": "https://www.wibu.com/support/user/user-software.html" }, { "category": "no_fix_planned", "details": "This product is obsolete. Therefore Phoenix Contact will not provide a fix. Please see mitigation section and update the CodeMeter Runtime manually.", "group_ids": [ "CSAFGID-1002" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "environmentalScore": 8.6, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.6, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] } ], "title": "Improper Access Control in Local-Only Configuration Commands" }, { "cve": "CVE-2026-81574", "cwe": { "id": "CWE-134", "name": "Use of Externally-Controlled Format String" }, "notes": [ { "category": "description", "text": "In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51012", "CSAFPID-51018", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51008" ] }, "remediations": [ { "category": "none_available", "details": "Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.", "group_ids": [ "CSAFGID-1001" ], "restart_required": { "category": "system" }, "url": "https://www.phoenixcontact.com" }, { "category": "mitigation", "details": "Download and update to CodeMeter Runtime >=V8.41a or >=V9.10 which fixes this vulnerability. Fixed CodeMeter Runtime versions are available on the Wibu-Systems webpage wibu.com.", "group_ids": [ "CSAFGID-1001", "CSAFGID-1002" ], "restart_required": { "category": "system" }, "url": "https://www.wibu.com/support/user/user-software.html" }, { "category": "no_fix_planned", "details": "This product is obsolete. Therefore Phoenix Contact will not provide a fix. Please see mitigation section and update the CodeMeter Runtime manually.", "group_ids": [ "CSAFGID-1002" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "environmentalScore": 8.2, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] } ], "title": "Format String Vulnerability in Logger" }, { "cve": "CVE-2026-81575", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "notes": [ { "category": "description", "text": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51012", "CSAFPID-51018", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51008" ] }, "remediations": [ { "category": "none_available", "details": "Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.", "group_ids": [ "CSAFGID-1001" ], "restart_required": { "category": "system" }, "url": "https://www.phoenixcontact.com" }, { "category": "mitigation", "details": "Download and update to CodeMeter Runtime >=V8.41a or >=V9.10 which fixes this vulnerability. Fixed CodeMeter Runtime versions are available on the Wibu-Systems webpage wibu.com.", "group_ids": [ "CSAFGID-1001", "CSAFGID-1002" ], "restart_required": { "category": "system" }, "url": "https://www.wibu.com/support/user/user-software.html" }, { "category": "no_fix_planned", "details": "This product is obsolete. Therefore Phoenix Contact will not provide a fix. Please see mitigation section and update the CodeMeter Runtime manually.", "group_ids": [ "CSAFGID-1002" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] } ], "title": "Missing Sanity Checks for Buffer Lengths" }, { "cve": "CVE-2026-81576", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "description", "text": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51012", "CSAFPID-51018", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51008" ] }, "remediations": [ { "category": "none_available", "details": "Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.", "group_ids": [ "CSAFGID-1001" ], "restart_required": { "category": "system" }, "url": "https://www.phoenixcontact.com" }, { "category": "mitigation", "details": "Download and update to CodeMeter Runtime >=V8.41a or >=V9.10 which fixes this vulnerability. Fixed CodeMeter Runtime versions are available on the Wibu-Systems webpage wibu.com.", "group_ids": [ "CSAFGID-1001", "CSAFGID-1002" ], "restart_required": { "category": "system" }, "url": "https://www.wibu.com/support/user/user-software.html" }, { "category": "no_fix_planned", "details": "This product is obsolete. Therefore Phoenix Contact will not provide a fix. Please see mitigation section and update the CodeMeter Runtime manually.", "group_ids": [ "CSAFGID-1002" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.7, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 7.7, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] } ], "title": "Improper Authentication of Session Handles" }, { "cve": "CVE-2026-81572", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "description", "text": "In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51012", "CSAFPID-51018", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51008" ] }, "remediations": [ { "category": "none_available", "details": "Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.", "group_ids": [ "CSAFGID-1001" ], "restart_required": { "category": "system" }, "url": "https://www.phoenixcontact.com" }, { "category": "mitigation", "details": "Download and update to CodeMeter Runtime >=V8.41a or >=V9.10 which fixes this vulnerability. Fixed CodeMeter Runtime versions are available on the Wibu-Systems webpage wibu.com.", "group_ids": [ "CSAFGID-1001", "CSAFGID-1002" ], "restart_required": { "category": "system" }, "url": "https://www.wibu.com/support/user/user-software.html" }, { "category": "no_fix_planned", "details": "This product is obsolete. Therefore Phoenix Contact will not provide a fix. Please see mitigation section and update the CodeMeter Runtime manually.", "group_ids": [ "CSAFGID-1002" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017", "CSAFPID-51018" ] } ], "title": "Local Privilege Escalation in CodeMeter Runtime on Windows" } ] }