Skip to content
Fencer Vulns
critical 9.8

CVE-2023-3935 json

Wibu: Buffer Overflow in CodeMeter Runtime

published 2023-09-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44561

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

Patch / fix

  • Wibu CodeMeter Runtime 7.21g

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-076-01 updated cvss 9.8

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-320-03 updated cvss 9.0

Siemens Desigo CC product family

  • Siemens Desigo CC family V5.0 Siemens Desigo CC family V5.1 Siemens Desigo CC family V6 Siemens Desigo CC family V7 Siemens SENTRON powermanager >=V4.0
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-257-06 updated cvss 9.0

Siemans WIBU Systems CodeMeter

  • Siemens PSS(R)CAPE V14 <V14.2023-08-23
    affected: vendor fix, workaround, mitigation
  • Siemens PSS(R)CAPE V15 <V15.0.22
    affected: fixed in V15.0.22, workaround, mitigation
  • Siemens PSS(R)E V34 <V34.9.6
    affected: fixed in V34.9.6, workaround, mitigation
  • Siemens PSS(R)E V35 <V35.6.1
    affected: fixed in V35.6.1, workaround, mitigation
  • Siemens PSS(R)ODMS V13.0
    affected: vendor fix, workaround, mitigation
  • Siemens PSS(R)ODMS V13.1 <V13.1.12.1
    affected: fixed in V13.1.12.1, workaround, mitigation
  • Siemens SIMATIC PCS neo V3 Siemens SIMATIC PCS neo V4.0
    affected: workaround, mitigation, no fix planned
  • Siemens SIMATIC WinCC OA V3.17 <V3.17_P030
    affected: fixed in V3.17, workaround, mitigation winccoa.com
show 5 more
  • Siemens SIMATIC WinCC OA V3.18 <V3.18_P021
    affected: fixed in V3.18, workaround, mitigation winccoa.com
  • Siemens SIMATIC WinCC OA V3.19 <V3.19_P006
    affected: fixed in V3.19, workaround, mitigation winccoa.com
  • Siemens SIMIT Simulation Platform >=V10.0<V11.2
    affected: fixed in V11.2, workaround, mitigation support.industry.siemens.com
  • Siemens SINEC INS <V1.0_SP2_Update_2
    affected: fixed in V1.0, workaround, mitigation support.industry.siemens.com
  • Siemens SINEMA Remote Connect
    affected: workaround, mitigation, no fix planned

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-004-01 updated cvss 7.5

Rockwell Automation FactoryTalk Activation

  • Rockwell Automation Factory Talk Activation Manager <V4.00_Utilizes_Wibu-Systems_CodeMeter_7.60c
    affected: mitigation “Users of the affected software are encouraged to apply the risk mitigations, if possible:” rockwellautomation.custhelp.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-25-182-02 updated cvss 9.8

FESTO Automation Suite, FluidDraw, and Festo Didactic Products

  • FESTO Didactic CIROS Studio / Education >=6.0.0, <=6.4.6, >=7.0.0, <=7.1.7
    affected: vendor fix wibu.com
  • Festo Automation Suite <=2.6.0.481 FESTO FluidDraw P6_<=6.2k, 365_<=7.0a
    affected: vendor fix
  • FESTO Didactic FluidSIM 5_all, 6_<=6.1c FESTO Didactic MES-PC <shipped_December_2023
    affected: vendor fix wibu.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction

1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Wibu CodeMeter Runtime

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.