PT-2020-6604 · Wibu Systems · Codemeter

Published 2020-09-16 · Updated 2021-11-04 · CVE-2020-14517

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeMeter versions prior to 6.90 CodeMeter version 6.90 or newer, if CodeMeter Runtime is running as server

Description The issue is related to the use of defective cryptographic algorithms in the CodeMeter software, which can be exploited by an attacker to remotely communicate with the CodeMeter API. This may allow the attacker to execute arbitrary code.

Recommendations For CodeMeter versions prior to 6.90, update to version 6.90 or later to resolve the issue. For CodeMeter version 6.90 or newer, if CodeMeter Runtime is running as server, consider disabling the server functionality to prevent external connections until a patch is available. As a temporary workaround, restrict access to the CodeMeter API to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-326

CWE-327

Related Identifiers

BDU:2022-00986

CVE-2020-14517

Affected Products

Codemeter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-14517 · Security Note
• https://bdu.fstec.ru/vul/2022-00986 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14517 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220222.2.pdf · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01 · Note