Summary
A local privilege escalation vulnerability in Phoenix Contact products utilizing WIBU-SYSTEMS CodeMeter Runtime allows users to gain admin rights on freshly installed systems. The CodeMeter Control Center starts with elevated privileges and retains them until restarted, enabling unauthorized access to admin tools like cmd.exe.
Impact
The effect is that CodeMeter Control Center can be launched once as administrator and will remain with these privileges until it is either manually closed or the user is logged out. In this case a malicious user can navigate, for example, to C:\Windows\System32\ and right-click on cmd.exe and select "open", thus getting an administrator console. This vulnerability only affects freshly installed systems until CodeMeter Control Center is restarted.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Activation Wizard <1.8 | Activation Wizard <1.8 | |
| 1662166 | CLIPX ENGINEER ASSEMBLE <=1.0.0 | CLIPX ENGINEER ASSEMBLE <=1.0.0 |
| 1153520, 1153516, 1153513, 1086891, 1086889 | EV Charging Suite (all upgrades) <=1.7.0 | EV Charging Suite (all upgrades) <=1.7.0 |
| 1153509, 1153508, 1128335, 1086929, 1086921, 1086920 | EV Charging Suite (all versions) <=1.7.0 | EV Charging Suite (all versions) <=1.7.0 |
| 2702889 | FL Network Manager <=8.0 | FL Network Manager <=8.0 |
| 1697763 | MLnext Creation <=24.10.0 | MLnext Creation <=24.10.0 |
| 1391115 | MLnext Execution <=1.1.3 | MLnext Execution <=1.1.3 |
| 1373907, 1373909, 1373233, 1373910, 1373226, 1373236, 1373231, 1373224, 1373913, 1373912, 1373238, 1373914, 1373915, 1373916, 1373917, 1373918, 1373908, 1550573, 1550576, 1550581, 1550587, 1550580, 1550582, 1532628, 1550574, 1550589 | MORYX-Software Platform | Activation Wizard <1.8 |
| 1046008 | PLCnext Engineer <2025.0.3 | PLCnext Engineer <2025.0.3 |
| 1165889 | PLCnext Engineer EDU LIC <2025.0.3 | PLCnext Engineer EDU LIC <2025.0.3 |
Vulnerabilities
Expand / Collapse allWibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.
Mitigation
After installing the CodeMeter Control Center (at least once), please perform one of the following actions:
- Restart your system
- Log-out and log-in in
- Manually close or restart the CodeMeter Control Center via the system tray icon
These steps must be followed immediately after installing the CodeMeter Runtime or any product that includes the CodeMeter Runtime.
Remediation
PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V8.30a, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V8.30a has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage.
Additional Recommendations:
Regularly check the product's official webpage for updated release versions that support CodeMeter V8.30a.
Update the Activation Wizard to version 1.8 as soon as it becomes available on the product's download page.
Acknowledgments
Phoenix Contact GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination. (see https://certvde.com )
- WIBU-SYSTEMS for reporting.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 09/09/2025 09:00 | Initial |