Codemeter Runtime
CVE-2014-8419
HIGH
Severity by source
AV:L/AC:L/Au:N/C:C/I:C/A:C
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file.
AnalysisAI
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-264. Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file. Affected products include: Wibu Codemeter Runtime. Version information: before 5.20.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Codemeter Runtime
View allA heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthentic
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes a
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed dat
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file withou
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today