CVE-2023-3935: Wibu: Buffer Overflow in CodeMeter Runtime

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-13 · updated 2026-06-17
Weakness: CWE-787

Description

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

Affected products

Phoenixcontact Activation Wizard: through 1.6
Phoenixcontact E-Mobility Charging Suite: through 1.7.0
Phoenixcontact Fl Network Manager: through 7.0
Phoenixcontact Iol-Conf: through 1.7.0
Phoenixcontact Module Type Package Designer: before 1.2.0; 1.2.0-beta — fixed in 1.2.0
PHOENIX CONTACT PLCnext Engineer: through 2023.6
TRUMPF Oseon: from 1.0.0 through 3.0.22
TRUMPF Programmingtube: from 1.0.1 through 4.6.3
TRUMPF Teczonebend: from 18.02.r8 through 23.06.01
TRUMPF Tops Unfold: 05.03.00.00
TRUMPF Topscalculation: from 14.00 through 22.00.00
Trumpflicenseexpert: from 1.5.2 through 1.11.1
TRUMPF Trutops: from 08.00 through 12.01.00.00
TRUMPF Trutops Cell Classic: through 09.09.02
TRUMPF Trutops Cell Sw48: from 01.00 through 02.26.0
TRUMPF Trutops Mark 3D: from 01.00 through 06.01
TRUMPF Trutopsboost: from 06.00.23.00 through 16.0.22
TRUMPF Trutopsfab: from 15.00.23.00 through 22.8.25
TRUMPF Trutopsfab Storage Smallstore: from 14.06.20 through 20.04.20.00
TRUMPF Trutopsprint: from 00.06.00 through 01.00
TRUMPF Trutopsprintmultilaserassistant: from 01.02
TRUMPF Trutopsweld: from 7.0.198.241 through 9.0.28148.1
TRUMPF Tubedesign: from 08.00 through 14.06.150
Wibu CodeMeter Runtime: before 7.60c — fixed in 7.60c

How to fix

Upgrade to a fixed version: Phoenixcontact Module Type Package Designer 1.2.0; Wibu CodeMeter Runtime 7.60c. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3935 or the next vulnerability affects your stack