{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.","title":"Summary"},{"category":"description","text":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","title":"Mitigation"},{"category":"description","text":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"psirt@endress.com","name":"Endress+Hauser AG","namespace":"https://www.endress.com"},"references":[{"category":"self","summary":"VDE-2022-019: Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components - HTML","url":"https://certvde.com/en/advisories/VDE-2022-019/"},{"category":"self","summary":"VDE-2022-019: Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components - CSAF","url":"https://endress-hauser.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-019.json"},{"category":"external","summary":"Vendor PSIRT","url":"https://www.endress.com"},{"category":"external","summary":"CERT@VDE Security Advisories for Endress+Hauser AG","url":"https://certvde.com/en/advisories/vendor/endress-hauser/"}],"title":"Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components","tracking":{"aliases":["VDE-2022-019"],"current_release_date":"2022-06-02T15:11:00.000Z","generator":{"date":"2025-06-23T09:40:56.803Z","engine":{"name":"Secvisogram","version":"2.5.28"}},"id":"VDE-2022-019","initial_release_date":"2022-06-02T15:11:00.000Z","revision_history":[{"date":"2022-06-02T15:11:00.000Z","number":"1.0.0","summary":"Initial revision."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"1.02.xx<=1.07.06","product":{"name":"DeviceCare 1.02.xx<=1.07.06","product_id":"CSAFPID-51001","product_identification_helper":{"model_numbers":["SFE100"]}}},{"category":"product_version","name":"1.07.07","product":{"name":"DeviceCare 1.07.07","product_id":"CSAFPID-52001","product_identification_helper":{"model_numbers":["SFE100"]}}}],"category":"product_name","name":"DeviceCare"},{"branches":[{"category":"product_version_range","name":"2.15.xx<=2.16.xx","product":{"name":"FieldCare 2.15.xx<=2.16.xx","product_id":"CSAFPID-51002","product_identification_helper":{"model_numbers":["SFE500"]}}},{"category":"product_version","name":"2.17.00","product":{"name":"FieldCare 2.17.00","product_id":"CSAFPID-52002","product_identification_helper":{"model_numbers":["SFE500"]}}}],"category":"product_name","name":"FieldCare"},{"branches":[{"category":"product_version_range","name":"1.4.0<=1.6.2","product":{"name":"Field Data Manager 1.4.0<=1.6.2","product_id":"CSAFPID-51003","product_identification_helper":{"model_numbers":["MS21"]}}},{"category":"product_version","name":"1.6.3","product":{"name":"Field Data Manager 1.6.3","product_id":"CSAFPID-52003","product_identification_helper":{"model_numbers":["MS21"]}}}],"category":"product_name","name":"Field Data Manager"},{"branches":[{"category":"product_version_range","name":"1.03.xx<=1.05.xx","product":{"name":"Field Xpert 1.03.xx<=1.05.xx","product_id":"CSAFPID-51004","product_identification_helper":{"model_numbers":["SMT50"]}}},{"category":"product_version","name":"1.06.00","product":{"name":"Field Xpert 1.06.00","product_id":"CSAFPID-52004","product_identification_helper":{"model_numbers":["SMT50"]}}}],"category":"product_name","name":"Field Xpert"},{"branches":[{"category":"product_version","name":"V1.3.7926","product":{"name":"Proline Promag W 800 OPC/UA Connectivity Server V1.3.7926","product_id":"CSAFPID-51005"}}],"category":"product_name","name":"Proline Promag W 800 OPC/UA Connectivity Server"},{"branches":[{"category":"product_version_range","name":"3.0.x<=3.4.x","product":{"name":"SupplyCare Enterprise 3.0.x<=3.4.x","product_id":"CSAFPID-51006","product_identification_helper":{"model_numbers":["SCE31B"]}}},{"category":"product_version","name":"3.5.1","product":{"name":"SupplyCare Enterprise 3.5.1","product_id":"CSAFPID-52005","product_identification_helper":{"model_numbers":["SCE31B"]}}}],"category":"product_name","name":"SupplyCare Enterprise"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"Endress+Hauser"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"],"summary":"Affected products."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"summary":"Fixed products."}]},"vulnerabilities":[{"cve":"CVE-2021-22901","cwe":{"id":"CWE-416","name":"Use After Free"},"notes":[{"category":"description","text":"curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":8.1,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":8.1,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-22901"},{"cve":"CVE-2021-41183","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"notes":[{"category":"description","text":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":6.1,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":6.1,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-41183"},{"cve":"CVE-2021-41182","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"notes":[{"category":"description","text":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":6.1,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":6.1,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-41182"},{"cve":"CVE-2020-8286","cwe":{"id":"CWE-295","name":"Improper Certificate Validation"},"notes":[{"category":"description","text":"curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","environmentalScore":7.5,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":7.5,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2020-8286"},{"cve":"CVE-2021-41184","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"notes":[{"category":"description","text":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":6.1,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":6.1,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-41184"},{"cve":"CVE-2021-20093","cwe":{"id":"CWE-125","name":"Out-of-bounds Read"},"notes":[{"category":"description","text":"A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.1,"environmentalSeverity":"CRITICAL","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":9.1,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-20093"},{"cve":"CVE-2021-41057","cwe":{"id":"CWE-59","name":"Improper Link Resolution Before File Access ('Link Following')"},"notes":[{"category":"description","text":"In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","environmentalScore":7.1,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":7.1,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-41057"},{"cve":"CVE-2021-20094","cwe":{"id":"CWE-125","name":"Out-of-bounds Read"},"notes":[{"category":"description","text":"A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002","CSAFPID-52003","CSAFPID-52004","CSAFPID-52005"],"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]},"remediations":[{"category":"mitigation","details":"All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.\nThe version is available at https://www.wibu.com/support.\nFor the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the software application of the affected products:\n\n| #                                 | Product Name                                  | Fixed Version     |\n|----------------------------------|-----------------------------------------------|-------------------|\n| SCE30B                           |                                               |                   |\n| SCE31B                           | SupplyCare Enterprise                         | >= 3.5.1          |\n| SCE32B                           |                                               |                   |\n| SFE100                           | DeviceCare                                    | >= 1.07.07        |\n| SFE500                           | FieldCare                                     | >= 2.17.00        |\n| SMT50                            |                                               |                   |\n| SMT70                            | Field Xpert                                   | >= 1.06.00        |\n| SMT77                            |                                               |                   |\n| MS20                             |                                               |                   |\n| MS21                             | Field Data Manager                            | >= 1.6.3          |\n| Freeware for the                 |                                               |                   |\n| Proline Promag W 800/5W8C        | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926     |\n| via Endress+Hauser Download Portal |                                             |                   |","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","environmentalScore":7.5,"environmentalSeverity":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":7.5,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006"]}],"title":"CVE-2021-20094"}]}