CVE-2023-3935: Wibu CodeMeter Runtime RCE Vulnerability

CVE-2023-3935 Overview

A heap buffer overflow vulnerability exists in the Wibu CodeMeter Runtime network service up to version 7.60b. This critical flaw allows an unauthenticated, remote attacker to achieve remote code execution (RCE) and gain full access to the host system. The vulnerability is classified as CWE-787 (Out-of-bounds Write), indicating improper memory handling that can lead to complete system compromise.

Critical Impact

Unauthenticated attackers can remotely execute arbitrary code and gain complete control of affected systems running Wibu CodeMeter Runtime without any user interaction required.

Affected Products

• Wibu CodeMeter Runtime (up to version 7.60b)
• TRUMPF Industrial Software Suite (OSEON, TruTops, TruTopsFab, TruTopsPrint, TruTopsWeld, and related products)
• Phoenix Contact Industrial Tools (PLCnext Engineer, FL Network Manager, IOL-CONF, E-Mobility Charging Suite, Activation Wizard)

Discovery Timeline

• September 13, 2023 - CVE-2023-3935 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-3935

Vulnerability Analysis

This heap buffer overflow vulnerability affects the CodeMeter Runtime network service, a widely deployed software protection and licensing solution used across industrial and manufacturing environments. The vulnerability allows remote attackers to send specially crafted network packets that trigger an out-of-bounds write condition in the heap memory region.

When exploited, the attacker can corrupt adjacent memory structures, potentially overwriting function pointers or other critical data structures. This memory corruption can be leveraged to redirect program execution flow, ultimately achieving arbitrary code execution with the privileges of the CodeMeter service process.

The network-accessible nature of the service combined with the lack of authentication requirements makes this vulnerability particularly dangerous in industrial environments where CodeMeter is commonly deployed for software licensing across TRUMPF manufacturing equipment and Phoenix Contact automation tools.

Root Cause

The root cause is improper bounds checking when processing incoming network data in the CodeMeter Runtime service. The service fails to adequately validate the size of input data before copying it into a fixed-size heap buffer, allowing attackers to write beyond the allocated memory boundaries. This out-of-bounds write (CWE-787) condition occurs in the network service component that handles license management communications.

Attack Vector

The attack is conducted over the network against the CodeMeter Runtime service, which typically listens on TCP port 22350. An attacker can exploit this vulnerability by:

1. Identifying systems running vulnerable versions of CodeMeter Runtime
2. Crafting malicious network packets designed to overflow the heap buffer
3. Sending the crafted packets to the target service without authentication
4. Leveraging the memory corruption to execute arbitrary code with service privileges

The exploitation requires no user interaction and can be performed by any network-accessible attacker, making it suitable for automated exploitation in enterprise environments.

Detection Methods for CVE-2023-3935

Indicators of Compromise

• Unusual network traffic patterns targeting TCP port 22350 (CodeMeter default port)
• Unexpected process crashes or restarts of CodeMeter.exe or related services
• Anomalous child processes spawned by the CodeMeter Runtime service
• Memory access violations or heap corruption warnings in system logs

Detection Strategies

• Deploy network intrusion detection rules to monitor for malformed packets targeting CodeMeter services on port 22350
• Implement endpoint detection and response (EDR) monitoring for unexpected behavior from CodeMeter Runtime processes
• Enable Windows Event Log monitoring for application crashes and heap corruption events related to CodeMeter components
• Utilize vulnerability scanners to identify systems running vulnerable CodeMeter Runtime versions below 7.60c

Monitoring Recommendations

• Monitor network connections to CodeMeter Runtime services from unexpected source addresses
• Track process execution chains originating from CodeMeter service executables
• Implement file integrity monitoring for CodeMeter installation directories
• Configure alerts for unusual memory usage patterns in CodeMeter Runtime processes

How to Mitigate CVE-2023-3935

Immediate Actions Required

• Update Wibu CodeMeter Runtime to version 7.60c or later immediately
• If immediate patching is not possible, restrict network access to the CodeMeter service (TCP port 22350) using firewalls
• Audit all systems for affected TRUMPF and Phoenix Contact software that may include vulnerable CodeMeter versions
• Implement network segmentation to isolate industrial systems running CodeMeter from untrusted networks

Patch Information

Wibu Systems has released CodeMeter Runtime version 7.60c which addresses this heap buffer overflow vulnerability. Organizations should update all instances of CodeMeter Runtime to version 7.60c or later. For products that bundle CodeMeter Runtime (such as TRUMPF and Phoenix Contact software), consult the respective vendor advisories for patched versions:

• Wibu Security Advisory WIBU-230704-01
• VDE Security Advisory VDE-2023-030
• VDE Security Advisory VDE-2023-031

Workarounds

• Block or restrict access to TCP port 22350 at the network firewall level to prevent remote exploitation
• Disable the CodeMeter network service if remote licensing functionality is not required in your environment
• Implement network segmentation to ensure CodeMeter services are only accessible from trusted management networks
• Deploy host-based firewalls on systems running CodeMeter to limit inbound connections to authorized IP addresses only

# Example: Block CodeMeter port using Windows Firewall
netsh advfirewall firewall add rule name="Block CodeMeter Inbound" dir=in action=block protocol=tcp localport=22350

# Example: Allow CodeMeter only from trusted management subnet
netsh advfirewall firewall add rule name="Allow CodeMeter Trusted" dir=in action=allow protocol=tcp localport=22350 remoteip=10.0.100.0/24