Description

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-27T10:16:39.943Z",
  "pubdate": "2026-08-27T10:16:39.943Z",
  "executiveSummary": "The CodeMeter Runtime environment is susceptible to an improper authorization vulnerability when configured in server mode, specifically affecting versions prior to 8.41a and 9.10.\nThe vulnerability originates from a failure to enforce network-origin restrictions within the configuration command handler.\nAn unauthenticated, remote attacker can interface with the configuration command handler, which was intended exclusively for local or trusted same-network clients.\nSuccessful exploitation allows for the unauthorized reading of sensitive configuration data and the modification of the Server.ini file.\nA critical risk implication is the potential for full WebAdmin takeover, as the attacker can overwrite the WebAdmin credential hashes stored within the configuration files.\nThis vulnerability grants remote actors the ability to manipulate server settings and compromise administrative access without prior authentication.",
  "technicalDetails": "The vulnerability resides within the CodeMeter Runtime configuration command handler, which operates when the software is set to function as a server. The root cause is a deficiency in input validation and access control logic, specifically the failure to verify the origin or network segment of incoming commands sent to the configuration interface.\nUnder normal operating conditions, these specific administrative commands are restricted to local execution or trusted clients within the local network perimeter. However, the lack of strict origin-based authorization allows an attacker to bypass these intended constraints and reach the handler over the network.\nThe attack flow proceeds as follows: 1) The attacker establishes a network connection to the target CodeMeter Runtime server. 2) The attacker issues crafted commands through the insecure configuration handler. 3) Because the handler does not differentiate between local/trusted and remote unauthorized peers, it processes the malicious request. 4) The attacker gains the capability to perform arbitrary read operations on system configuration files or overwrite parameters within the Server.ini file.\nThe scope of the impact is particularly severe due to the contents of the Server.ini file. By overwriting specific configuration entries, an attacker can manipulate the state of the CodeMeter WebAdmin interface. Specifically, the ability to overwrite the credential hash allows an attacker to perform a credential reset or injection, enabling a full WebAdmin account takeover.\nThis vulnerability is classified as a remote command and configuration injection flaw. It requires no authentication to trigger, as the interface itself acts as an unauthenticated gateway to administrative functions. The exploitation is facilitated by the service being exposed as a server, effectively expanding the attack surface to any network reachable by the attacker.\nPost-exploitation impact includes the full compromise of the CodeMeter WebAdmin administrative portal, potential unauthorized access to license management, and general configuration manipulation which could be leveraged for persistence or further lateral movement within the environment hosting the CodeMeter service."
}