Please be aware not all mitigations apply to every possible product configuration, so please check which of these could be relevant or applicable.

The following measures are recommended to reduce the risk until the fixed version can be installed. Update to the latest version of the CodeMeter Runtime.Jokūbas Arsoba reported this vulnerability to Wibu-Systems. CRITICAL INFRASTRUCTURE SECTORS: Multiple.A CVSS v3 base score of 7.1 has been assigned the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). This could result in overwriting of essential files or a crash of the CodeMeter Runtime Server.ĬVE-2021-41057 has been assigned to this vulnerability. CodeMeter Runtime: All versions prior to Version 7.30aģ.2 VULNERABILITY OVERVIEW 3.2.1 IMPROPER PRIVILEGE MANAGEMENT CWE-269Ī local attacker using the Microsoft Windows OS could cause CodeMeter Runtime to improperly control file access permissions by setting up a link to a special system file used with CmDongles.The following versions of CodeMeter Runtime, a license manger, are affected: Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server, which could cause a denial-of-service condition. Vulnerability: Improper Privilege Management.The user can also reserve licenses for network users, Active Directory groups, or specific computers and create usage reports. License Server: The license is stored in a CmDongle or a CmActLicense on a license server in the LAN of the user.CmCloudLicense: The license is typically tied to one user and located on a secure server operated by Wibu-Systems in the cloud.Alternatively, you can employ unbound CmActLicenses via the CodeMeter Protection Only or the CodeMeter Trial License options. When using virtual machines, you can specify whether the license remains valid if it is moved or copied to a virtual machine. You define the degree of tolerance to changes in the computer. CmActLicense: The license is saved in a special file that is bound to the hardware of the target computer.CmDongles are available in several form factors, such as USB, SD card, microSD card, CF card, CFast Card, and ASIC. Once saved, the secret keys never leave the unit.

The device embeds a smart card chip, which offers additional security to CodeMeter’s technology.

CmDongle: The license is stored securely in a CmDongle.

CodeMeter with a SAP back office solution.

SAP Entitlement Management and CodeMeter.

Protection of Server Software from Wibu-Systems: prevent privacy and protect data.

Codemeter runtime server reason