CVE-2021-20093
Critical
Description
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.
SeverityCritical
CVSS9.1
Exploit probability—
ProductWibu Codemeter
PublishedJun 16, 2021
First seenJun 16, 2021
How to fix
Update
- siemens simatic_pcs_neo3.1 or later
- siemens simit_simulation_platform10.3 or later
- siemens sinec_infrastructure_network_services1.0.1.1 or later
- siemens sinema_remote_connect_server3.0 or later
- siemens simatic_process_historian2020 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wibu codemeter | v ≤ 7.21a | — |
| siemens pss_cape | No range specified | — |
| siemens sicam_230_firmware | No range specified | — |
| siemens simatic_information_server | 2019, 2020 | — |
| siemens simatic_pcs_neo | v < 3.1 | 3.1 |
| siemens simatic_wincc_oa | 3.17, 3.18 | — |
| siemens simit_simulation_platform | 10.0 ≤ v < 10.3, 10.3 | 10.3 |
| siemens sinec_infrastructure_network_services | v < 1.0.1.1, 1.0.1 | 1.0.1.1 |
| siemens sinema_remote_connect_server | v < 3.0, 3.0 | 3.0 |
| siemens simatic_process_historian | 2019 ≤ v < 2020, 2020 | 2020 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.