CVE-2021-20093
Estado: ModificadaCrítica (9.1)—
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Puntuación base: 9.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 33%
- Percentil entre todas las CVEs puntuadas: 98
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (10)
Siemens — PSS CapeSiemens — Sicam 230 FirmwareSiemens — Simatic Information ServerSiemens — Simatic PCS NEOSiemens — Simatic Process HistorianSiemens — Simatic Wincc OASiemens — Simit Simulation PlatformSiemens — Sinec Infrastructure Network ServicesSiemens — Sinema Remote Connect ServerWibu — Codemeter
CWE
- CWE-125
Referencias
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02
- https://www.tenable.com/security/research/tra-2021-24
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02
- https://www.tenable.com/security/research/tra-2021-24
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-20093",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "vulnreport@tenable.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Wibu-Systems CodeMeter",
"versions": [
{
"status": "affected",
"version": "< 7.21a"
}
]
}
]
}
],
"published": "2021-06-16T12:15:12.037",
"references": [
{
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "vulnreport@tenable.com"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "vulnreport@tenable.com"
},
{
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "vulnreport@tenable.com"
},
{
"url": "https://www.tenable.com/security/research/tra-2021-24",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"source": "vulnreport@tenable.com"
},
{
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.tenable.com/security/research/tra-2021-24",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de lectura excesiva del búfer en Wibu-Systems CodeMeter versiones anteriores a 7.21a. Un atacante remoto no autenticado puede explotar este problema para revelar el contenido de la memoria de la pila o bloquear el CodeMeter Runtime Server"
}
],
"lastModified": "2026-06-17T03:33:15.837",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu:codemeter:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "703D0DCC-23C2-4E57-A273-B6BDA05D424C",
"versionEndIncluding": "7.21a"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:pss_cape:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "890BA38B-38CD-4B6D-96E8-A786CFFE4C35"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:sicam_230_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A559DA1A-EB9D-4F93-9649-D69BF916BEE4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:sicam_230:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "702949EB-ED2D-4E85-802B-93EEA4FA939E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:simatic_information_server:2019:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BB95C8C-188D-430F-9D59-7F5E1832A0A5"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_information_server:2020:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBF9131D-6408-443C-9322-2E31B1A87CB0"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "884EC00C-1155-436D-94F4-C6F2303732CF",
"versionEndExcluding": "3.1"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc_oa:3.17:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "305D0C1C-16AF-4011-B449-F266FFA6FA3B"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_wincc_oa:3.18:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2832A89E-57BE-4BB2-94AC-17DC3CFD91FA"
},
{
"criteria": "cpe:2.3:a:siemens:simit_simulation_platform:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64235511-8464-440C-ACD4-B3D046552735",
"versionEndExcluding": "10.3",
"versionStartIncluding": "10.0"
},
{
"criteria": "cpe:2.3:a:siemens:simit_simulation_platform:10.3:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2603C1BD-9B47-4936-B1D2-6D425B764B81"
},
{
"criteria": "cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B0F46497-4AB0-49A7-9453-CC26837BF253",
"versionEndExcluding": "1.0.1.1"
},
{
"criteria": "cpe:2.3:a:siemens:sinec_infrastructure_network_services:1.0.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5145C088-C0B0-44EB-A852-74695BCF3806"
},
{
"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F65F9901-F4BD-4484-9749-D5022245D686",
"versionEndExcluding": "3.0"
},
{
"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:3.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F03BAD5-7B90-4212-ACBC-3C878C02CDAA"
},
{
"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:3.0:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5BACE03-50A7-4279-8CA5-2BB95224D485"
},
{
"criteria": "cpe:2.3:h:siemens:simatic_process_historian:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73659BCA-7F7A-45D4-AB01-07932B16EA59",
"versionEndExcluding": "2020",
"versionStartIncluding": "2019"
},
{
"criteria": "cpe:2.3:h:siemens:simatic_process_historian:2020:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5DB15E6-296B-48DE-945E-48196595B58B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "vulnreport@tenable.com"
}