A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of
several Festo products, was found. This could lead to remote code execution and escalation of
privileges giving full admin access on the host system. 

Update A, 2023-12-05

  • removed "MES4 (v3)", "MES4 (<=v2)" and Energy-PC from affected products as they do not install the affected WIBU Codemeter release.



A heap-based buffer overflow caused by libcurl and wrong whitespace character interpretation
in Javascript, both used in CodeMeter Runtime affecting multiple products by PHOENIX CONTACT.



Affected products are vulnerable to remote code execution via command injection in the web-based management by an attacker.



There is a misconfiguration of access rights to a configuration tool of the web-based-management for a specific user, which allows to reset passwords of other users (except root). This allows an authenticated attacker to elevate his privileges.



Multiple Weidmueller products are affected by recent WIBU vulnerability.



Feeds

Nach Hersteller

Archiv

2024
2023
2022
2021
2020
2019
2018
2017

Legende

(Scoring für CVSS 2.0,3.0+3.1)
keine
Kein CVE verfügbar
Niedrig
0.1 <= 3.9
Mittel
4.0 <= 6.9
Hoch
7.0 <= 8.9
Kritisch
9.0 <= 10.0