CVE-2021-20093 Information disclosure in Wibu-Systems CodeMeter
An unauthenticated remote attacker can disclose heap memory contents or crash the CodeMeter Runtime Server via a buffer over-read vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20093?
CVE-2021-20093 is a critical vulnerability in Siemens Sinec Infrastructure Network Services, published on 16 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.
Weakness: CWE-125
Which versions are affected by CVE-2021-20093?
It affects 10 products.
Products include Siemens Pss Cape, Siemens Sicam 230 Firmware, Siemens Simatic Information Server, Siemens Simatic Pcs Neo, Siemens Simatic Process Historian, Siemens Simatic Wincc Oa and 4 more.
How do I fix CVE-2021-20093?
No fix has been published for CVE-2021-20093 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20093 being exploited?
There is no known exploitation of CVE-2021-20093 in the wild and no public exploit code.
Other vulnerabilities in Siemens Sinec Infrastructure Network Services
All Siemens Sinec Infrastructure Network Services vulnerabilities
Sources
Also known as GHSA-m5xx-rgqg-j2m6.