8.6
Élevée
CVE-2026-81573 If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not…
Description
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| codemeter-runtime 9.00 | 9.00 → < 9.10 | 9.10 |
| codemeter-runtime 8.00 | 8.00 → < 8.41a | 8.41a |
| codemeter-runtime | 7.x | Pas de correctif indiqué |
| codemeter-runtime | 6.x | Pas de correctif indiqué |
Autres CVE de codemeter-runtime
Les 5 CVE de codemeter-runtime →
CVE-2026-81576
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies…
7.7
Élevée
CVE-2026-81575
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which…
7.5
Élevée
CVE-2026-81574
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases,…
8.2
Élevée
CVE-2026-81572
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file…
7.8
Élevée