PT-2020-3963 · Wibu Systems · Codemeter

Published 2020-09-07 · Updated 2021-11-04 · CVE-2020-14509

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CodeMeter versions prior to 7.10

Description: The issue is related to memory corruption vulnerabilities in the packet parser mechanism of CodeMeter, where it fails to verify length fields. This could allow an attacker to send specially crafted packets and exploit these vulnerabilities, potentially leading to arbitrary code execution.

Recommendations: For versions prior to 7.10, update to version 7.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the packet parser mechanism to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-805

Related Identifiers

BDU:2020-04356

CVE-2020-14509

Affected Products

Codemeter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-14509 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14509 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04356 · Security Note
• https://wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-200521-03.pdf · Note
• https://t.me/cvenotify/22992 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf · Note
• https://wibu.com/support/security-advisories.html · Note