CVE-2026-81573 Overview
CVE-2026-81573 is an improper access control vulnerability [CWE-284] in WIBU-SYSTEMS CodeMeter Runtime versions before 8.41a and 9.10. When CodeMeter Runtime operates as a server, the configuration command handler fails to enforce network-origin restrictions. Commands intended only for local or same-network clients can be executed by arbitrary remote peers over the network.
An attacker can read sensitive configuration data and overwrite selected values in Server.ini. The overwritten data includes the hash of the credentials for the CodeMeter WebAdmin interface, which enables complete WebAdmin takeover.
Critical Impact
Unauthenticated remote attackers can modify server configuration and hijack CodeMeter WebAdmin credentials, leading to administrative takeover of licensing infrastructure.
Affected Products
- WIBU-SYSTEMS CodeMeter Runtime versions before 8.41a
- WIBU-SYSTEMS CodeMeter Runtime versions before 9.10
- CodeMeter deployments configured as a server
Discovery Timeline
- 2026-08-27 - CVE-2026-81573 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-81573
Vulnerability Analysis
CodeMeter Runtime is a licensing and protection framework widely deployed in industrial software, engineering tools, and control system environments. When configured as a server, the runtime exposes a network service that processes configuration commands from clients.
The configuration command handler processes privileged operations without validating the network origin of the request. Commands that should only be accepted from local processes or same-subnet peers are executed regardless of where they originate. This design flaw removes the primary trust boundary the software relies on for administrative separation.
An attacker who reaches the CodeMeter server port can invoke configuration read and write operations. Reading returns sensitive configuration values, including the WebAdmin credential hash. Writing allows modification of Server.ini fields, which the attacker can weaponize to replace the stored WebAdmin credential hash and log in as an administrator.
Root Cause
The root cause is missing enforcement of network-origin restrictions in the configuration command handler [CWE-284]. The service does not distinguish between local, same-network, and remote peers before executing sensitive commands.
Attack Vector
Exploitation requires network reachability to the CodeMeter server port. No authentication or user interaction is required. An attacker sends crafted configuration commands to the exposed service, reads the WebAdmin credential hash from Server.ini, and overwrites configuration values to gain WebAdmin access. Refer to the WIBU Security Advisory #103401 for protocol-level details.
Detection Methods for CVE-2026-81573
Indicators of Compromise
- Unexpected modifications to the CodeMeter Server.ini file, particularly changes to the WebAdmin credential hash field
- WebAdmin login sessions from unfamiliar source addresses or outside normal administrative windows
- Inbound connections to the CodeMeter server port from hosts outside the expected local network segment
- New or altered configuration entries that were not applied by an authorized administrator
Detection Strategies
- Monitor file integrity on the CodeMeter Server.ini file and alert on any unauthorized modification
- Inspect network flows to the CodeMeter service port and flag remote peers that were previously local-only
- Correlate WebAdmin authentication events with configuration file changes to identify credential hash substitution
Monitoring Recommendations
- Enable verbose logging on the CodeMeter Runtime service and forward logs to a centralized SIEM for analysis
- Baseline expected client subnets for the CodeMeter server and alert on connections outside that baseline
- Track WebAdmin administrative actions and review any privilege changes that follow configuration writes
How to Mitigate CVE-2026-81573
Immediate Actions Required
- Upgrade CodeMeter Runtime to version 8.41a, 9.10, or later on all systems configured as servers
- Inventory all hosts running CodeMeter Runtime and confirm whether the server role is enabled
- Rotate WebAdmin credentials after patching to invalidate any hashes that may have been exfiltrated
- Restrict network access to the CodeMeter service port using host and network firewalls
Patch Information
WIBU-SYSTEMS has released fixed versions in CodeMeter Runtime 8.41a and 9.10. The updated releases enforce network-origin restrictions on the configuration command handler. Consult the WIBU Security Advisory #103401 for the authoritative vendor guidance and download instructions.
Workarounds
- Block inbound access to the CodeMeter server port at the perimeter and restrict to trusted management subnets
- Disable the CodeMeter server role on hosts that do not require network licensing services
- Place CodeMeter server hosts on isolated network segments accessible only to authorized license clients
- Apply strict host-based firewall rules limiting the service to loopback or specific administrative IP ranges until patching is complete
# Configuration example: restrict CodeMeter server access with Windows firewall
netsh advfirewall firewall add rule name="CodeMeter-Restrict" dir=in action=block protocol=TCP localport=22350
netsh advfirewall firewall add rule name="CodeMeter-Allow-Trusted" dir=in action=allow protocol=TCP localport=22350 remoteip=10.0.0.0/24
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
