Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: wibu-systems-ag codemeter-runtime — cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/A… Clear all filters
TI-2026-56283 CVE-2026-81576 · GHSA-gj9j-5pfx-gc7p

Improper Authentication of Session Handles

Priority LOW 34

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-08-27 Fixed in 9.10, 8.41a CWE-639
TI-2026-56282 CVE-2026-81575 · GHSA-ccvp-8vxx-4m3m

Missing Sanity Checks for Buffer Lengths

Priority LOW 33

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-08-27 Fixed in 9.10, 8.41a +2 CWE-130
TI-2026-56281 CVE-2026-81574 · GHSA-7c2r-g494-h73x

Format String Vulnerability in Logger

Priority MEDIUM 42

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00426 Published 2026-08-27 Fixed in 9.10, 8.41a +1 CWE-134
TI-2026-56280 CVE-2026-81573 · GHSA-4vcw-h879-447q

Improper Access Control in Local-Only Configuration Commands

Priority MEDIUM 43

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00395 Published 2026-08-27 Fixed in 9.10, 8.41a CWE-284