SSA-201595

Siemens Security Advisory by Siemens ProductCERT

SSA-201595: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager

Publication Date:	2025-08-14
Last Update:	2025-08-14
Current Version:	V1.0
CVSS v3.1 Base Score:	8.2

SUMMARY

Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege escalation.

Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
Desigo CC family	Show more details
Desigo CC family V5.0 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
Desigo CC family V5.1 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
Desigo CC family V6 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
Desigo CC family V7 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
Desigo CC family V8 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
SENTRON Powermanager	Show more details
SENTRON Powermanager V5 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
SENTRON Powermanager V6 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
SENTRON Powermanager V7 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'
SENTRON Powermanager V8 All versions affected by CVE-2025-47809	Apply patch as documented in section 'Additional Information'

WORKAROUNDS AND MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

Desigo CC product family consists of Desigo CC (an integrated building management platform for managing high-performing buildings), Desigo CC Compact (a tailored solution for small and medium-sized buildings), Desigo CC Connect (a software gateway based on the Desigo CC platform), and Cerberus DMS (a danger management station that helps users manage fire safety and security events).

SENTRON Powermanager power monitoring software analyzes energy consumption by displaying important characteristics for individual devices and for the entire system on an easy-to-understand dashboard.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2025-47809

Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.

CVSS v3.1 Base Score	8.2
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE	CWE-272: Least Privilege Violation

ADDITIONAL INFORMATION

Please follow below steps to update the WIBU CodeMeter :

Uninstall the previous installed version of CodeMeter via Control Panel
Install the Codemeter V8.30a (Refer: https://www.wibu.com/us/support.html)
Restart client/server after installation of CodeMeter

For more details regarding the vulnerability in CodeMeter Runtime refer to:

WIBU Systems Security Advisory WIBU-100120: https://www.wibu.com/support/security-advisories/wibu-100120.html

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2025-08-14):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.