| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| Activation Wizard | < 1.8 | |
| CLIPX ENGINEER ASSEMBLE | <= 1.0.0 | |
| EV Charging Suite (all upgrades) | <= 1.7.0 | |
| EV Charging Suite (all versions) | <= 1.7.0 | |
| FL Network Manager | <= 8.0 | |
| MLnext Creation | <= 24.10.0 | |
| MLnext Execution | <= 1.1.3 | |
| MTP DESIGNER / MTP DESIGNER TRAIL | <= 1.3.1 | |
| PLCnext Engineer | < 2025.0.3 | |
| PLCnext Engineer EDU LIC | < 2025.0.3 |
A local privilege escalation vulnerability in Phoenix Contact products utilizing WIBU-SYSTEMS CodeMeter Runtime allows users to gain admin rights on freshly installed systems. The CodeMeter Control Center starts with elevated privileges and retains them until restarted, enabling unauthorized access to admin tools like cmd.exe.
Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.
The effect is that CodeMeter Control Center can be launched once as administrator and will remain with these privileges until it is either manually closed or the user is logged out. In this case a malicious user can navigate, for example, to C:\Windows\System32\ and right-click on cmd.exe and select "open", thus getting an administrator console. This vulnerability only affects freshly installed systems until CodeMeter Control Center is restarted.
General Recommendation
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note.
Mitigation
After installing the CodeMeter Control Center (at least once), please perform one of the following actions:
These steps must be followed immediately after installing the CodeMeter Runtime or any product that includes the CodeMeter Runtime.
Remediation
PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V8.30a, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V8.30a has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage.
Additional Recommendations: Regularly check the product's official webpage for updated release versions that support CodeMeter V8.30a. Update the Activation Wizard to version 1.8 as soon as it becomes available on the product's download page.
CERT@VDE coordinated with Phoenix Contact GmbH & Co. KG.
WIBU-SYSTEMS for reporting.