Vulnerability Description
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wibu | Codemeter Runtime | < 7.60c |
| Trumpf | Oseon | >= 1.0.0, <= 3.0.22 |
| Trumpf | Programmingtube | >= 1.0.1, <= 4.6.3 |
| Trumpf | Teczonebend | >= 18.02.r8, <= 23.06.01 |
| Trumpf | Tops Unfold | 05.03.00.00 |
| Trumpf | Topscalculation | >= 14.00, <= 22.00.00 |
| Trumpf | Trumpflicenseexpert | >= 1.5.2, <= 1.11.1 |
| Trumpf | Trutops | >= 08.00, <= 12.01.00.00 |
| Trumpf | Trutops Cell Classic | <= 09.09.02 |
| Trumpf | Trutops Cell Sw48 | >= 01.00, <= 02.26.0 |
| Trumpf | Trutops Mark 3D | >= 01.00, <= 06.01 |
| Trumpf | Trutopsboost | >= 06.00.23.00, <= 16.0.22 |
| Trumpf | Trutopsfab | >= 15.00.23.00, <= 22.8.25 |
| Trumpf | Trutopsfab Storage Smallstore | >= 14.06.20, <= 20.04.20.00 |
| Trumpf | Trutopsprint | >= 00.06.00, <= 01.00 |
| Trumpf | Trutopsprintmultilaserassistant | >= 01.02 |
| Trumpf | Trutopsweld | >= 7.0.198.241, <= 9.0.28148.1 |
| Trumpf | Tubedesign | >= 08.00, <= 14.06.150 |
| Phoenixcontact | Activation Wizard | <= 1.6 |
| Phoenixcontact | E-Mobility Charging Suite | <= 1.7.0 |
Related Weaknesses (CWE)
References
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-2Vendor Advisory
- https://cert.vde.com/en/advisories/VDE-2023-030/Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-031/Third Party Advisory
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-2Vendor Advisory
- https://cert.vde.com/en/advisories/VDE-2023-030/Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-031/Third Party Advisory
FAQ
What is CVE-2023-3935?
CVE-2023-3935 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
How severe is CVE-2023-3935?
CVE-2023-3935 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-3935?
Check the references section above for vendor advisories and patch information. Affected products include: Wibu Codemeter Runtime, Trumpf Oseon, Trumpf Programmingtube, Trumpf Teczonebend, Trumpf Tops Unfold.