CVE-2023-3935
📋 TL;DR
CVE-2023-3935 is a critical heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service that allows unauthenticated remote attackers to execute arbitrary code and gain full control of affected systems. This affects all systems running CodeMeter Runtime versions up to 7.60b with the network service enabled. The vulnerability is network-accessible and requires no authentication.
💻 Affected Systems
- Wibu CodeMeter Runtime
📦 What is this software?
Activation Wizard by Phoenixcontact
E Mobility Charging Suite by Phoenixcontact
Fl Network Manager by Phoenixcontact
Iol Conf by Phoenixcontact
Module Type Package Designer by Phoenixcontact
Module Type Package Designer by Phoenixcontact
Oseon by Trumpf
Plcnext Engineer by Phoenixcontact
Trutops by Trumpf
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full administrative control, data theft, ransomware deployment, and persistent backdoor installation.
Likely Case
Remote code execution leading to system takeover, lateral movement within networks, and deployment of malware or ransomware.
If Mitigated
Limited impact if network segmentation isolates CodeMeter systems and strict firewall rules prevent external access.
🎯 Exploit Status
The vulnerability requires no authentication and has a straightforward exploitation path for remote code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 7.70 or later
Vendor Advisory: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf
Restart Required: Yes
Instructions:
1. Download CodeMeter Runtime version 7.70 or later from Wibu Systems website. 2. Stop all CodeMeter services. 3. Install the updated version. 4. Restart the system to ensure all services are running with the patched version.
🔧 Temporary Workarounds
Disable CodeMeter Network Service
allDisable the vulnerable network service component while maintaining local license functionality
Windows: sc stop CodeMeter.exe
Linux: systemctl stop codemeter
Network Segmentation and Firewall Rules
allBlock external access to CodeMeter network service ports (default TCP 22350, 22351)
Windows Firewall: netsh advfirewall firewall add rule name="Block CodeMeter" dir=in action=block protocol=TCP localport=22350,22351
Linux iptables: iptables -A INPUT -p tcp --dport 22350:22351 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate CodeMeter systems from untrusted networks
- Deploy host-based intrusion detection/prevention systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check CodeMeter Runtime version and verify if network service is running. Versions ≤7.60b with network service enabled are vulnerable.Check Version:
Windows: "C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" --version | Linux: /usr/sbin/CodeMeter --versionVerify Fix Applied:
Verify CodeMeter Runtime version is 7.70 or later and that the network service is either disabled or properly firewalled.📡 Detection & Monitoring
Log Indicators:
- Unusual network connections to CodeMeter ports (22350/22351)
- CodeMeter service crashes or unexpected restarts
- Unusual process creation from CodeMeter executable
Network Indicators:
- Unusual traffic patterns to/from CodeMeter ports
- Exploit attempts against port 22350/22351
- Unexpected outbound connections from CodeMeter systems
SIEM Query:
source="CodeMeter" AND (event_type="crash" OR event_type="unexpected_restart") OR destination_port IN (22350, 22351) AND source_ip NOT IN (trusted_ips)🔗 References
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf
- https://cert.vde.com/en/advisories/VDE-2023-030/
- https://cert.vde.com/en/advisories/VDE-2023-031/
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf
- https://cert.vde.com/en/advisories/VDE-2023-030/
- https://cert.vde.com/en/advisories/VDE-2023-031/
