Disable the container type “Mass Storage” in CodeMeter.

Restrict unprivileged access to machines running the CodeMeter License Server service.

Please be aware not all mitigations apply to every possible product configuration, so please check which of these could be relevant or applicable. The following measures are recommended to reduce the risk until the fixed version can be installed.

Update to the latest version of the CodeMeter Runtime.

Jokūbas Arsoba reported this vulnerability to Wibu-Systems.

CRITICAL INFRASTRUCTURE SECTORS: Multiple.

A CVSS v3 base score of 7.1 has been assigned the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). This could result in overwriting of essential files or a crash of the CodeMeter Runtime Server.ĬVE-2021-41057 has been assigned to this vulnerability.

CodeMeter Runtime: All versions prior to Version 7.30aģ.2 VULNERABILITY OVERVIEW 3.2.1 IMPROPER PRIVILEGE MANAGEMENT CWE-269Ī local attacker using the Microsoft Windows OS could cause CodeMeter Runtime to improperly control file access permissions by setting up a link to a special system file used with CmDongles.

The following versions of CodeMeter Runtime, a license manger, are affected: Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server, which could cause a denial-of-service condition.

Vulnerability: Improper Privilege Management.

The right licenses are placed into that container, and the user receives a credential file back for their local device. The license portal communicates with the CodeMeter Cloud Server and creates a CmCloudContainer for each user. To activate the license, the user accesses the license portal on their browser or uses the Software Activation Wizard via CodeMeter’s dedicated gateway. All steps are securely logged in CodeMeter License Central or on the CodeMeter Cloud Server to keep the developer in full control at all times. Once the user has received that ticket, they can complete the rest of the process without any further need for the developer to be involved. The process begins with a ticket that represents the entitlement to one or more licenses.

by a CRM or ERP system like SAP or another e-commerce solution. Typically, the licenses would be created in CodeMeter License Central, as ordered e.g. When serving larger groups of users, the ability to automate the creation of their CmCloudContainers would be the ideal solution. Individual software protection traning from Wibu-Systems: security, reliability, flexibility.Training in software licensing and software protection.

Secure Password Management for the Siemens TIA Portal.

Integrating CodeMeter License Central in an SAP back office solution.

SAP Entitlement Management and Wibu-Systems CodeMeter.

Codemeter runtime server user account