CVE-2025-47809: Wibu CodeMeter Privilege Escalation Flaw

CVE-2025-47809 Overview

CVE-2025-47809 is a local privilege escalation vulnerability in Wibu CodeMeter versions before 8.30a. The flaw exists in the CodeMeter Control Center component and can be exploited immediately after installation, before a logoff or reboot occurs. An unprivileged local user who performed an installation with User Account Control (UAC) elevation can navigate from the Import License dialog to a privileged instance of Windows Explorer. This grants the attacker code execution in an elevated security context. The vulnerability is classified under [CWE-272] Least Privilege Violation and reflects improper handling of privileged UI components launched from an unprivileged session.

Critical Impact
A local unprivileged user can escalate to SYSTEM-level access through the Import License workflow in CodeMeter Control Center immediately after installation.

Affected Products

Wibu CodeMeter versions before 8.30a
CodeMeter Control Center component (Windows installations)
Systems where CodeMeter was installed with UAC elevation and not restarted

Discovery Timeline

2025-05-16 - CVE-2025-47809 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47809

Vulnerability Analysis

The vulnerability affects the CodeMeter Control Center, a user-facing component of the Wibu CodeMeter licensing suite. During installation performed by an unprivileged user through UAC, the CodeMeter Control Center inherits an elevated security context. That context persists in the running process until the user logs off, reboots, or the component is restarted. A local attacker with access to the same interactive session can interact with this elevated process before it is refreshed.

The Import License function within the Control Center opens a file selection dialog running under the privileged token. Windows file dialogs allow navigation to Windows Explorer through address bar manipulation, right-click context menus, or file operations. This traversal path yields a explorer.exe instance running with elevated privileges, enabling arbitrary command execution and file system operations as the elevated user.

Root Cause

The root cause is a Least Privilege Violation [CWE-272] where the CodeMeter Control Center retains installer-inherited elevated privileges after setup. The Import License user interface does not restrict outbound navigation from the file picker, allowing the attacker to spawn additional privileged processes from a GUI element that should be sandboxed.

Attack Vector

Exploitation requires local interactive access, unprivileged installation performed with UAC elevation, and that the CodeMeter Control Center has not been restarted since installation. The attacker opens the Control Center, selects Import License, and uses the file dialog to launch a privileged Windows Explorer window. From that Explorer instance the attacker can execute binaries, modify protected files, or spawn a privileged shell. No network access, authentication credentials, or user interaction from another account are required.

Detection Methods for CVE-2025-47809

Indicators of Compromise

Creation of explorer.exe child processes from CodeMeterCC.exe running with elevated integrity levels
New privileged processes spawned shortly after a CodeMeter installation event on Windows hosts
Command line executions launched from Explorer windows opened via a CodeMeter file dialog
Modifications to protected directories (C:\Windows\System32, Program Files) by users lacking administrative group membership

Detection Strategies

Monitor process trees for CodeMeterCC.exe spawning explorer.exe or cmd.exe at High or System integrity levels
Correlate MSI installer events for CodeMeter with subsequent privileged process launches in the same session
Alert on file dialog-based navigation resulting in shell launches from licensing or third-party utility processes
Baseline CodeMeter Control Center behavior and flag deviations in child process integrity levels

Monitoring Recommendations

Enable Windows Security auditing for process creation (Event ID 4688) with command line logging
Collect Sysmon Event ID 1 for full parent-child process chain visibility on hosts running CodeMeter
Track UAC elevation events (Event ID 4672) attributed to interactive user sessions after software installations
Ingest endpoint telemetry into a SIEM or data lake for retroactive hunting across installations of CodeMeter prior to version 8.30a

How to Mitigate CVE-2025-47809

Immediate Actions Required

Upgrade Wibu CodeMeter to version 8.30a or later on all affected Windows systems
Force a reboot or logoff on any host where CodeMeter was recently installed but not yet restarted
Restrict local interactive access on systems running vulnerable CodeMeter versions until patched
Audit endpoints for CodeMeter installations and confirm current running version through inventory tools

Patch Information

Wibu-Systems has released CodeMeter 8.30a addressing this issue. Refer to the Wibu Security Advisory for official remediation guidance and downloadable packages. Administrators should validate the patched version is running by checking the CodeMeter Control Center About dialog or the installed program version in Windows.

Workarounds

Restart the CodeMeter Control Center or reboot the host immediately after installation to drop the elevated token
Deploy CodeMeter only through administrator-initiated installations that do not leave elevated GUI components in unprivileged user sessions
Apply application control policies to prevent explorer.exe from being launched as a child of CodeMeterCC.exe
Limit which local users can execute the CodeMeter Control Center on multi-user systems

bash

# Verify installed CodeMeter version on Windows via PowerShell
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like 'CodeMeter*' } | Select-Object Name, Version

# Force restart of the CodeMeter service to drop elevated tokens
Stop-Service -Name CodeMeter.exe -Force
Start-Service -Name CodeMeter.exe