What’s Vulnerable › Vulnerabilities
CVE-2021-41057
- Severity: high (CVSS 7.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-11-14 · updated 2026-06-17
- Weakness: CWE-59
Description
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.
Affected products
- Siemens Pss Cape: 14
- Siemens Pss E: from 34.0.0 before 34.9.1; from 35.0.0 before 35.3.2 — fixed in 34.9.1, 35.3.2
- Siemens Pss Odms: before 12.2.6.1 — fixed in 12.2.6.1
- Siemens Sicam 230: before 8.0 — fixed in 8.0
- Siemens Simatic Information Server: before 2019; 2019, 2019-sp1 — fixed in 2019
- Siemens SIMATIC PCS neo: all versions
- Siemens Simatic Process Historian: through 2019
- Siemens SIMATIC WinCC OA: through 3.18
- Siemens Simit: through 10.0
- Wibu CodeMeter Runtime: before 7.30a — fixed in 7.30a
How to fix
Upgrade to a fixed version: Siemens Pss E 34.9.1, 35.3.2; Siemens Pss Odms 12.2.6.1; Siemens Sicam 230 8.0; Siemens Simatic Information Server 2019; Wibu CodeMeter Runtime 7.30a. Check the vendor advisory for mitigations.
References
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf
- https://www.wibu.com/us/support/security-advisories.html
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf
- https://www.wibu.com/us/support/security-advisories.html
Get alerted when CVE-2021-41057 or the next vulnerability affects your stack