CVE-2021-20093
critical · 9.1A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.
9.1
CVSS
33.3%
EPSS (exploit prob.)
98th
EPSS percentile
2021-06-16
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-125
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| wibu | codemeter | <= 7.21a |
| siemens | pss_cape | all versions |
| siemens | sicam_230_firmware | all versions |
| siemens | sicam_230 | all versions |
| siemens | simatic_information_server | 2019 |
| siemens | simatic_information_server | 2020 |
| siemens | simatic_pcs_neo | < 3.1 |
| siemens | simatic_wincc_oa | 3.17 |
| siemens | simatic_wincc_oa | 3.18 |
| siemens | simit_simulation_platform | >= 10.0, < 10.3 |
| siemens | simit_simulation_platform | 10.3 |
| siemens | sinec_infrastructure_network_services | < 1.0.1.1 |
| siemens | sinec_infrastructure_network_services | 1.0.1 |
| siemens | sinema_remote_connect_server | < 3.0 |
| siemens | sinema_remote_connect_server | 3.0 |
| siemens | sinema_remote_connect_server | 3.0 |
| siemens | simatic_process_historian | >= 2019, < 2020 |
| siemens | simatic_process_historian | 2020 |
Check a specific version with /api/v1/cve/match.
References
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02
- https://www.tenable.com/security/research/tra-2021-24
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02
- https://www.tenable.com/security/research/tra-2021-24
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-20093