CVE-2020-14515
First published: Wed Sep 16 2020(Updated: )
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wibu Codemeter | <6.90 | |
| Wibu-Systems AG All versions prior to 7.10a are affected by CVE-2020-14509 and CVE-2020-14519 | ||
| Wibu-Systems AG All versions prior to 7.10a are affected by CVE-2020-14517 | ||
| Wibu-Systems AG All versions prior to 7.10 are affected by CVE-2020-16233 | ||
| Wibu-Systems AG All versions prior to 6.81 are affected by CVE-2020-14513 | ||
| Wibu-Systems AG All versions prior to 6.90 are affected by CVE-2020-14515 when using CmActLicense update files with CmActLicense Firm Code |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this CodeMeter vulnerability?
The vulnerability ID for this CodeMeter vulnerability is CVE-2020-14515.
What is the severity of vulnerability CVE-2020-14515?
The severity of vulnerability CVE-2020-14515 is high with a CVSS score of 7.5.
Which versions of CodeMeter are affected by CVE-2020-14515?
All versions prior to 6.90 of CodeMeter are affected by CVE-2020-14515.
What is the impact of this vulnerability?
This vulnerability allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file.
Is there a fix for CVE-2020-14515 vulnerability?
Yes, the fix for CVE-2020-14515 is to update CodeMeter to version 6.90 or later.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/weakness
- agent/softwarecombine
- agent/references
- agent/severity
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- alias/CVE-2020-14519
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wibu
- canonical/wibu codemeter
- vendor/wibu-systems ag
- canonical/wibu-systems ag all versions prior to 7.10a are affected by cve-2020-14509 and cve-2020-14519
- canonical/wibu-systems ag all versions prior to 7.10a are affected by cve-2020-14517
- canonical/wibu-systems ag all versions prior to 7.10 are affected by cve-2020-16233
- canonical/wibu-systems ag all versions prior to 6.81 are affected by cve-2020-14513
- canonical/wibu-systems ag all versions prior to 6.90 are affected by cve-2020-14515 when using cmactlicense update files with cmactlicense firm code