CVE-2021-41057
High
Description
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.
SeverityHigh
CVSS7.1
Exploit probability—
ProductWibu Codemeter Runtime
PublishedNov 14, 2021
First seenNov 14, 2021
How to fix
Update
- wibu codemeter_runtime7.30a or later
- siemens pss_e34.9.1, 35.3.2 or later
- siemens pss_odms12.2.6.1 or later
- siemens sicam_2308.0 or later
- siemens simatic_information_server2019 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wibu codemeter_runtime | v < 7.30a | 7.30a |
| siemens pss_cape | 14 | — |
| siemens pss_e | 34.0.0 ≤ v < 34.9.1, 35.0.0 ≤ v < 35.3.2 | 34.9.1, 35.3.2 |
| siemens pss_odms | v < 12.2.6.1 | 12.2.6.1 |
| siemens sicam_230 | v < 8.0 | 8.0 |
| siemens simatic_information_server | v < 2019, 2019 | 2019 |
| siemens simatic_pcs_neo | No range specified | — |
| siemens simatic_process_historian | v ≤ 2019 | — |
| siemens simatic_wincc_oa | v ≤ 3.18 | — |
| siemens simit | v ≤ 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.