EUVD-2026-66980
GHSA-4vcw-h879-447q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
AV:N and PR:N confirmed by unauthenticated remote handler access; I:H reflects credential hash overwrite enabling WebAdmin takeover; C:L for readable but limited config data; A:L for potential service disruption via config overwrite.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
AnalysisAI
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires CodeMeter Runtime to be deployed in server mode - client-only installations are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) accurately reflects the threat profile: the vulnerability is network-reachable, requires no authentication, and has low attack complexity once a server-mode instance is reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the CodeMeter configuration handler port over the network sends unauthenticated configuration commands to read Server.ini contents, extracting the WebAdmin credential hash. The attacker either cracks the hash offline or overwrites it with a hash of a known password, then authenticates to the CodeMeter WebAdmin interface with full administrative privileges. … |
| Remediation | Upgrade CodeMeter Runtime to version 8.41a or 9.10 (or later within each respective branch) as documented in the WIBU security advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct emergency inventory to identify all systems running CodeMeter Runtime before versions 8.41a or 9.10 in server mode and map network exposure; immediately implement network segmentation to restrict access to CodeMeter configuration service ports to trusted internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codemeter Runtime
View allA heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthentic
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes a
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed dat
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file withou
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today