SSA-507364

Siemens Security Advisory by Siemens ProductCERT

SSA-507364: Heap Based Buffer Overflow Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager

Publication Date:	2026-02-10
Last Update:	2026-02-10
Current Version:	V1.0
CVSS v3.1 Base Score:	8.8

SUMMARY

Versions V6.0 through V8 QU1 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could lead to code execution in the context of the current process.

Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
Desigo CC family	Show more details
Desigo CC family V6 All versions affected by CVE-2023-38545	Apply patch as documented in section 'Additional Information'
Desigo CC family V7 All versions affected by CVE-2023-38545	Apply patch as documented in section 'Additional Information'
Desigo CC family V8 All versions < V8.0 QU2 affected by CVE-2023-38545	Update to V8.0 QU2 or later version https://support.industry.siemens.com/cs/ww/en/view/109997962/
SENTRON Powermanager	Show more details
SENTRON Powermanager V6 All versions affected by CVE-2023-38545	Apply patch as documented in section 'Additional Information'
SENTRON Powermanager V7 All versions affected by CVE-2023-38545	Apply patch as documented in section 'Additional Information'
SENTRON Powermanager V8 All versions < V8.0 QU2 affected by CVE-2023-38545	Update to V8.0 QU2 or later version https://support.industry.siemens.com/cs/ww/en/view/109771760/

KNOWN NOT AFFECTED PRODUCTS

Un-/Collapse All

Known Not Affected Products	Reason
Desigo CC family V9 All versions not affected by CVE-2023-38545	The product does not contain affected WIBU CodeMeter Runtime component (Component Not Present)
SENTRON Powermanager V9 All versions not affected by CVE-2023-38545	The product does not contain affected WIBU CodeMeter Runtime component (Component Not Present)

MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

Desigo CC is the integrated building management platform for managing high-performing buildings. With its open design, it has been developed to create comfortable, safe and efficient facilities. It is easily scalable from simple single-discipline systems to fully integrated buildings.

SENTRON Powermanager power monitoring software analyzes energy consumption by displaying important characteristics for individual devices and for the entire system on an easy-to-understand dashboard.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2023-38545

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.

If the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.

CVSS v3.1 Base Score	8.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE	CWE-122: Heap-based Buffer Overflow

ADDITIONAL INFORMATION

Please follow below steps to update the WIBU CodeMeter : - Uninstall the previous installed version of CodeMeter via Control Panel - Install WIBU Codemeter User Runtime V8.40b or later version (Download from: https://www.wibu.com/us/support/user/downloads-user-software.html) - Restart client/server after installation of CodeMeter For more details regarding the vulnerability in CodeMeter Runtime refer to: * WIBU Systems Security Advisory WIBU-231017-01: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-231017-01.pdf

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-02-10):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.