CVE-2021-20093

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 33.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-16 · updated 2026-06-17
Weakness: CWE-125

Description

A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.

Affected products

Siemens Pss Cape: all versions
Siemens Sicam 230 Firmware: all versions
Siemens Simatic Information Server: 2019-sp1, 2020
Siemens SIMATIC PCS neo: before 3.1 — fixed in 3.1
Siemens Simatic Process Historian: from 2019 before 2020; 2020 — fixed in 2020
Siemens SIMATIC WinCC OA: 3.17, 3.18
Siemens SIMIT Simulation Platform: from 10.0 before 10.3; 10.3 — fixed in 10.3
Siemens Sinec Infrastructure Network Services: before 1.0.1.1; 1.0.1 — fixed in 1.0.1.1
Siemens SINEMA Remote Connect Server: before 3.0; 3.0, 3.0-sp1 — fixed in 3.0
CodeMeter: through 7.21a

How to fix

Upgrade to a fixed version: Siemens SIMATIC PCS neo 3.1; Siemens Simatic Process Historian 2020; Siemens SIMIT Simulation Platform 10.3; Siemens Sinec Infrastructure Network Services 1.0.1.1; Siemens SINEMA Remote Connect Server 3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20093 or the next vulnerability affects your stack