Vulnerability-Lookup

VDE-2023-035

Vulnerability from csaf_codesysgmbh - Published: 2023-12-05 07:00 - Updated: 2023-12-05 07:00

Summary

CODESYS: Multiple products affected by WIBU Codemeter vulnerability

Notes

Summary: Several CODESYS setups contain and install vulnerable versions of the WIBU CodeMeter Runtime.

Impact: The CODESYS Development System is an IEC 61131-3 programming tool for PLCs based on the CODESYSControl runtime system, which enables embedded or PC-based devices to be a programmable industrialcontroller. All affected CODESYS products install and use the WIBU CodeMeter Runtime for licensemanagement. The manufacturer WIBU-SYSTEMS AG has reported a heap buffer overflow vulnerability in theWIBU CodeMeter Runtime, which can potentially lead to a remote code execution.

Mitigation: WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability. Until an update is available for the affected CODESYS products or if this is not to be installed, CODESYS GmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of WIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html). If neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).

Remediation: Update the following products to version 3.5.19.30. • CODESYS Control RTE (SL) • CODESYS Control RTE (for Beckhoff CX) SL • CODESYS Control Win (SL) • CODESYS HMI (SL) • CODESYS Development System • CODESYS OPC DA Server SL Update the following products to version to 4.10.0.0. • CODESYS Control for Linux SL • CODESYS Control for Linux ARM SL For the legacy CODESYS V2 products, no new version is scheduled.

CVE-2023-3935

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Mitigation WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability. Until an update is available for the affected CODESYS products or if this is not to be installed, CODESYS GmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of WIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html). If neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).

Vendor Fix Update the following products to version 3.5.19.30. • CODESYS Control RTE (SL) • CODESYS Control RTE (for Beckhoff CX) SL • CODESYS Control Win (SL) • CODESYS HMI (SL) • CODESYS Development System • CODESYS OPC DA Server SL Update the following products to version to 4.10.0.0. • CODESYS Control for Linux SL • CODESYS Control for Linux ARM SL For the legacy CODESYS V2 products, no new version is scheduled.

Affected products

Fixed 8 products

Product	Identifier	Version	Remediation
CODESYS Control for Linux ARM SL 4.10.0.0 CODESYS / Software / CODESYS Control for Linux ARM SL		4.10.0.0
CODESYS Control for Linux SL 4.10.0.0 CODESYS / Software / CODESYS Control for Linux SL		4.10.0.0
CODESYS Control RTE (for Beckhoff CX) SL 3.5.19.30 CODESYS / Software / CODESYS Control RTE (for Beckhoff CX) SL		3.5.19.30
CODESYS Control RTE (SL) 3.5.19.30 CODESYS / Software / CODESYS Control RTE (SL)		3.5.19.30
CODESYS Control Win (SL) 3.5.19.30 CODESYS / Software / CODESYS Control Win (SL)		3.5.19.30
CODESYS Development System 3.5.19.30 CODESYS / Software / CODESYS Development System		3.5.19.30
CODESYS HMI (SL) 3.5.19.30 CODESYS / Software / CODESYS HMI (SL)		3.5.19.30
CODESYS OPC OA Server SL 3.5.19.30 CODESYS / Software / CODESYS OPC OA Server SL		3.5.19.30

Known affected 9 products

Product	Identifier	Version	Remediation
CODESYS Control for Linux ARM SL <4.10.0.0 CODESYS / Software / CODESYS Control for Linux ARM SL		<4.10.0.0
CODESYS Control for Linux SL <4.10.0.0 CODESYS / Software / CODESYS Control for Linux SL		<4.10.0.0
CODESYS Control RTE (for Beckhoff CX) SL <3.5.19.30 CODESYS / Software / CODESYS Control RTE (for Beckhoff CX) SL		<3.5.19.30
CODESYS Control RTE (SL) <3.5.19.30 CODESYS / Software / CODESYS Control RTE (SL)		<3.5.19.30
CODESYS Control Win (SL) <3.5.19.30 CODESYS / Software / CODESYS Control Win (SL)		<3.5.19.30
CODESYS Software CODESYS Development System 2.3.9.45<3.5.19.30 CODESYS / Software / CODESYS Development System		2.3.9.45<3.5.19.30
CODESYS HMI (SL) <3.5.19.30 CODESYS / Software / CODESYS HMI (SL)		<3.5.19.30
CODESYS OPC OA Server SL <3.5.19.30 CODESYS / Software / CODESYS OPC OA Server SL		<3.5.19.30
CODESYS SP Realtime NT >=2.3.7.25 CODESYS / Software / CODESYS SP Realtime NT		>=2.3.7.25

References

4 references

URL	Category
https://certvde.com/en/advisories/VDE-2023-035/	self
https://codesys.csaf-tp.certvde.com/.well-known/c…	self
https://www.codesys.com	external
https://certvde.com/en/advisories/vendor/codesys/	external

Acknowledgments

CERT@VDE certvde.com

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Several CODESYS setups contain and install vulnerable versions of the WIBU CodeMeter Runtime.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The CODESYS Development System is an IEC 61131-3 programming tool for PLCs based on the CODESYSControl runtime system, which enables embedded or PC-based devices to be a programmable industrialcontroller. All affected CODESYS products install and use the WIBU CodeMeter Runtime for licensemanagement. The manufacturer WIBU-SYSTEMS AG has reported a heap buffer overflow vulnerability in theWIBU CodeMeter Runtime, which can potentially lead to a remote code execution.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability.\n\nUntil an update is available for the affected CODESYS products or if this is not to be installed, CODESYS\nGmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of\nWIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html).\n\nIf neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Update the following products to version 3.5.19.30.\n\n\u2022 CODESYS Control RTE (SL)\n\n\u2022 CODESYS Control RTE (for Beckhoff CX) SL\n\n\u2022 CODESYS Control Win (SL)\n\n\u2022 CODESYS HMI (SL)\n\n\u2022 CODESYS Development System \n\n\u2022 CODESYS OPC DA Server SL\n\nUpdate the following products to version to 4.10.0.0.\n\n\u2022 CODESYS Control for Linux SL\n\n\u2022 CODESYS Control\u00a0for Linux ARM SL\n\nFor the legacy CODESYS V2 products, no new version is scheduled.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@codesys.com",
      "name": "CODESYS GmbH",
      "namespace": "https://www.codesys.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-035: CODESYS: Multiple products affected by WIBU Codemeter vulnerability - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-035/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-035: CODESYS: Multiple products affected by WIBU Codemeter vulnerability - CSAF",
        "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-035.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.codesys.com"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for CODESYS GmbH",
        "url": "https://certvde.com/en/advisories/vendor/codesys/"
      }
    ],
    "title": "CODESYS: Multiple products affected by WIBU Codemeter vulnerability",
    "tracking": {
      "aliases": [
        "VDE-2023-035"
      ],
      "current_release_date": "2023-12-05T07:00:00.000Z",
      "generator": {
        "date": "2025-04-23T08:34:15.959Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2023-035",
      "initial_release_date": "2023-12-05T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-12-05T07:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux ARM SL \u003c4.10.0.0",
                      "product_id": "CSAFPID-51001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux ARM SL 4.10.0.0",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for Linux ARM SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux SL \u003c4.10.0.0",
                      "product_id": "CSAFPID-51002"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux SL 4.10.0.0",
                      "product_id": "CSAFPID-52002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for Linux SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (for Beckhoff CX) SL \u003c3.5.19.30",
                      "product_id": "CSAFPID-51003"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (for Beckhoff CX) SL 3.5.19.30",
                      "product_id": "CSAFPID-52003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control RTE (for Beckhoff CX) SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (SL) \u003c3.5.19.30",
                      "product_id": "CSAFPID-51004"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (SL) 3.5.19.30",
                      "product_id": "CSAFPID-52004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control RTE (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Control Win (SL) \u003c3.5.19.30",
                      "product_id": "CSAFPID-51005"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Control Win (SL) 3.5.19.30",
                      "product_id": "CSAFPID-52005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control Win (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "2.3.9.45\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Software CODESYS Development System 2.3.9.45\u003c3.5.19.30",
                      "product_id": "CSAFPID-51006"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Development System 3.5.19.30",
                      "product_id": "CSAFPID-52006"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Development System"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS HMI (SL) \u003c3.5.19.30",
                      "product_id": "CSAFPID-51007"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS HMI (SL) 3.5.19.30",
                      "product_id": "CSAFPID-52007"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS HMI (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS OPC OA Server SL \u003c3.5.19.30",
                      "product_id": "CSAFPID-51008"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS OPC OA Server SL 3.5.19.30",
                      "product_id": "CSAFPID-52008"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS OPC OA Server SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003e=2.3.7.25",
                    "product": {
                      "name": "CODESYS SP Realtime NT \u003e=2.3.7.25",
                      "product_id": "CSAFPID-51009"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS SP Realtime NT"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "CODESYS"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004",
          "CSAFPID-52005",
          "CSAFPID-52006",
          "CSAFPID-52007",
          "CSAFPID-52008"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004",
          "CSAFPID-52005",
          "CSAFPID-52006",
          "CSAFPID-52007",
          "CSAFPID-52008"
        ],
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability.\n\nUntil an update is available for the affected CODESYS products or if this is not to be installed, CODESYS\nGmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of\nWIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html).\n\nIf neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update the following products to version 3.5.19.30.\n\n\u2022 CODESYS Control RTE (SL)\n\n\u2022 CODESYS Control RTE (for Beckhoff CX) SL\n\n\u2022 CODESYS Control Win (SL)\n\n\u2022 CODESYS HMI (SL)\n\n\u2022 CODESYS Development System \n\n\u2022 CODESYS OPC DA Server SL\n\nUpdate the following products to version to 4.10.0.0.\n\n\u2022 CODESYS Control for Linux SL\n\n\u2022 CODESYS Control\u00a0for Linux ARM SL\n\nFor the legacy CODESYS V2 products, no new version is scheduled.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

CVE-2023-3935 (GCVE-0-2023-3935)

Vulnerability from cvelistv5 – Published: 2023-09-13 13:19 – Updated: 2025-08-27 20:32

Title

Wibu: Buffer Overflow in CodeMeter Runtime

Summary

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-26 21:50 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

CERTVDE CNA under the icscert root

CNA scorecard B 76/100 over 143 records in the last 180 days details

References

3 references

URL	Tags
https://cdn.wibu.com/fileadmin/wibu_downloads/sec…
https://cert.vde.com/en/advisories/VDE-2023-031/
https://cert.vde.com/en/advisories/VDE-2023-030/

Impacted products

2 products

Vendor	Product	Version
Wibu	CodeMeter Runtime	Affected: 0.0 , ≤ 7.60b (custom)
Wibu	CodeMeter Runtime	Unaffected: 7.21g

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:08:50.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2023-031/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2023-030/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3935",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T21:50:55.835781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T20:32:53.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CodeMeter Runtime",
          "vendor": "Wibu",
          "versions": [
            {
              "lessThanOrEqual": "7.60b",
              "status": "affected",
              "version": "0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "CodeMeter Runtime",
          "vendor": "Wibu",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21g"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system."
            }
          ],
          "value": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-19T07:00:20.911Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf"
        },
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2023-031/"
        },
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2023-030/"
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#64566"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Wibu: Buffer Overflow in CodeMeter Runtime",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2023-3935",
    "datePublished": "2023-09-13T13:19:18.392Z",
    "dateReserved": "2023-07-25T13:02:40.206Z",
    "dateUpdated": "2025-08-27T20:32:53.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted