CVE-2020-14517 Weak cryptography in CodeMeter

Critical 9.8 Published 16 Sep 2020 Updated 4 Aug 2024

Weak protocol encryption in CodeMeter Runtime allows attackers to bypass security and communicate with the API when running as a server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-14517?

CVE-2020-14517 is a critical vulnerability in CodeMeter, published on 16 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.

Weakness: CWE-327, CWE-326

Which versions are affected by CVE-2020-14517?

It affects 1 product.

Products include Wibu Codemeter.

How do I fix CVE-2020-14517?

No fix has been published for CVE-2020-14517 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-14517 being exploited?

There is no known exploitation of CVE-2020-14517 in the wild and no public exploit code.

Sources

Also known as GHSA-hqvx-g6jw-22pw.