Update CodeMeter Runtime to Fix CVE-2023-38545 in Desigo CC and Powermanager

Siemens’ ProductCERT has republished a high‑risk advisory: a heap‑based buffer overflow in the third‑party WIBU Systems CodeMeter Runtime (root cause: a vulnerable libcurl SOCKS5 handshake, CVE‑2023‑38545) is present inside several Desigo CC product family builds and the Desigo CC‑based SENTRON Powermanager, and Siemens is urging immediate update of the embedded CodeMeter Runtime to fixed versions.

Background / Overview​

Desigo CC is Siemens’ integrated building management platform; SENTRON Powermanager is a power‑monitoring dashboard built on the same Desigo CC base in some releases. Both product families include the WIBU CodeMeter Runtime component for licensing and protection, and several vendor advisories show multiple CodeMeter issues have been republished against Siemens products over the past two years.
The immediate advisory (Siemens SSA‑507364) describes a heap‑based buffer overflow that traces back to a libcurl SOCKS5 handshake bug tracked as CVE‑2023‑38545. Siemens’ remediation guidance is to update the CodeMeter Runtime shipped with affected Desigo CC / SENTRON builds to the vendor‑fixed CodeMeter runtime version and to follow the supplied update procedure. CISA and Siemens have republished and cross‑referenced these steps in their ICS advisories.
Why this matters: the vulnerable code path can lead to arbitrary code execution in the context of the vulnerable process if exploited. In railway, buildings, power monitoring and other critical‑infrastructure deployments where Desigo CC and SENTRON are used, such an exploit could have serious operational consequences if an attacker achieves remote or local access to an affected service.

---

What’s broken — technical summary​

The underlying library: libcurl’s SOCKS5 handshake (CVE‑2023‑38545)​

• The core issue is a heap‑based buffer overflow in the SOCKS5 proxy handshake code of libcurl (the library behind the curl tool). When curl hands a hostname to a SOCKS5 proxy (i.e., the proxy resolves the name), libcurl has a 255‑byte expectation for hostnames; a state machine bug can cause a too‑long hostname to be copied into a heap buffer, overflowing it during slow handshakes. This can crash the process or — with heap manipulation — enable arbitrary code execution.
• Affected libcurl versions: 7.69.0 through and including 8.3.0. The upstream fix is in curl/libcurl 8.4.0 (the library now returns an error instead of switching to a dangerous local‑resolve path). Workarounds include avoiding socks5h:// usage or ensuring the application sets a sufficiently large download buffer (CURLOPT_BUFFERSIZE).

The product integration: CodeMeter Runtime inside Siemens products​

• Siemens’ advisories show that certain Desigo CC and SENTRON Powermanager builds include a vulnerable WIBU CodeMeter Runtime that bundles or uses a vulnerable libcurl (or otherwise exposes the CodeMeter component that internally links to the affected code path). Siemens’ ProductCERT explicitly lists the affected product lines and recommends updating the CodeMeter component per vendor instructions.
• Separate but related: WIBU CodeMeter itself has had other advisories (for example, a privilege‑escalation issue fixed in CodeMeter 8.30a — CVE‑2025‑47809). Siemens’ earlier republications and mitigations reference that CodeMeter update path; the current advisory focuses on the heap overflow (CVE‑2023‑38545) and the required CodeMeter runtime update. Cross‑referencing both classes of CodeMeter advisories is important because many Siemens product lines will have different CodeMeter versions embedded.

---

Which Siemens products and versions are affected​

• Siemens lists multiple Desigo CC families (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS) and the Desigo CC–based SENTRON Powermanager as affected across a number of version lines. The recent SSA‑507364 advisory names: Desigo CC family V6.0 through V8 QU1 and SENTRON Powermanager lines prior to V8.0 QU2 as containing the vulnerable CodeMeter component. Where later product versions (for example, Desigo CC V9 / SENTRON Powermanager V9) do not include the affected CodeMeter runtime, Siemens marks those as not affected. Always map the installed product SKU + build to Siemens’ advisory tables to confirm status for each host.
• Historical context: Siemens has published multiple CodeMeter‑related security advisories over 2023–2026 (different CVEs and fixes), and product patch boundaries differ by Desigo CC major/minor release; operators must consult the per‑product advisory tables for exact remediation thresholds rather than assuming a single global version cut‑off.

---

Impact assessment — what an attacker could do​

• Remote code execution (RCE) inside the Desigo CC or Powermanager process is the practical worst case from this heap overflow. That would permit an attacker who can channel a crafted SOCKS5 flow (or otherwise induce the vulnerable behavior) to execute arbitrary code as the target process user. For server components that run with high privileges or service accounts, that could lead to deeper compromise.
• Denial of Service (DoS) is a lower‑effort impact: an overflow can be triggered to crash the process repeatedly, producing operational disruptions to BMS services and energy monitoring dashboards. In OT contexts, loss of visibility or management plane functionality can cause cascade effects.
• Privilege escalation / lateral movement: if an attacker obtains RCE on a monitoring or management node, they can attempt credential harvest, lateral movement, and persistent footholds inside the building or plant network. This is the core operational risk in ICS/OT: software vulnerabilities give an attacker a pathway to the physical world.

---

Siemens and WIBU remediation guidance (authoritative actions)​

• Siemens ProductCERT (SSA‑507364 / SSA‑201595 / SSA‑625850 family of advisories) and the CISA republications instruct operators to update the embedded CodeMeter Runtime to the vendor‑fixed version. For the CodeMeter installer privilege issue, WIBU published advisory WIBU‑100120 recommending CodeMeter >= 8.30a (and later updates) as the fix. Siemens advises uninstall/install steps or the vendor‑documented update procedure and a restart of client/server components after updating CodeMeter.
• If your Siemens ProductCERT advisory entry shows a fixed Desigo CC / Powermanager build (for example, V8.0 QU2 or later), update the product to that build per Siemens release notes; otherwise update the standalone CodeMeter Runtime per the vendor steps documented in the ProductCERT advisory. Always follow Siemens’ per‑product remediation table because the remediation path can differ between Desigo CC SKUs.
• CISA’s ICS advisory republished Siemens’ guidance and gives a short remediation checklist (uninstall the old CodeMeter, install CodeMeter V8.30a or later, restart services/hosts). Use the updated CodeMeter installer from WIBU’s official distribution channels and verify cryptographic checksums when available.

---

Practical, prioritized workplan for defenders (0–7 days)​

• Rapid inventory (0–8 hours)
• Enumerate all instances of Desigo CC and SENTRON Powermanager in your estate, including management/engineering workstations that host Installed Clients or CodeMeter support utilities.
• Record product build numbers, CodeMeter runtime version (if visible), and host OS details.
• Flag internet‑accessible and demilitarized‑zone reachable hosts as highest priority.
• Confirm exposure & triage (8–24 hours)
• Cross‑check product build strings against Siemens’ per‑SKU advisory tables to determine whether the installed product contains the affected CodeMeter component and the exact remediation for that SKU.
• If your environment uses any SOCKS5 proxies or configured proxy environment variables (socks5h://), list which applications and hosts rely on them — the underlying libcurl vulnerability is only exploitable in contexts where remote hostname resolution via SOCKS5 is used. If you do not use SOCKS5 reverse‑resolution, the immediate exploitation vector is reduced but not eliminated (some bundled components may still configure proxies).
• Apply vendor fixes (24–72 hours)
• If Siemens provides a fixed product build (e.g., Desigo CC V8.0 QU2 or laterled update to that build in a maintenance window and follow the vendor’s update checklist.
• Otherwise, apply WIBU CodeMeter Runtime updates exactly as Siemens documents: uninstall prior CodeMeter, install the fixed CodeMeter package (WIBU >= 8.30a or as Siemens prescribes for this advisory), and restart the service / host. Validate installation success by checking the CodeMeter Control Center version and the product’s self‑test pages.
• Compensating controls and containment (immediately until patched)
• Block outbound SOCKS5 (TCP 1080 and any non‑standard SOCKS5 ports) unless explicitly required for operations.
• Deny or tightly restrict proxy protocol negotiation (socks5h://) at network egress policies.
• Place affected hosts behind network segmentation and restrict management ports to known jump‑hosts; deny all inbound management access from untrusted networks.
• Test and validate (before and after deployment)
• Test the vendor update in a mirrored staging environment with active functional tests for Desigo CC and SENTRON flows.
• Validate that CodeMeter‑related licensing operations remain functional and that the product services restart cleanly.
• Keep patch records, restart confirmations, and verification checksums in your change control tickets.

---

Detection and hunting guidance​

• Network monitoring: watch for suspicious outbound SOCKS5 sessions and unusual DNS/proxy resolve behavior originating from management or server hosts. Many exploit chains rely on the client initiating traffic to attacker‑controlled infrastructure. Dropping SOCKS5 traffic to untrusted destinations and logging any such attempts will raise an early alarm.
• Host indicators:
• Presence of pre‑fix temp files, abnormal process restarts, or coredumps from Desigo CC or CodeMeter processes.
• Unexpected child processes spawned by service accounts that run Desigo CC or CodeMeter.
• Changes to binaries or unexpected DLL loads in processes that access CodeMeter or libcurl libraries.
• EDR/AV signatures: ensure endpoint detection tools are updated and tuned to monitor for exploitation patterns for libcurl heap corruption and for suspicious use of file‑dialogs or Explorer elevation patterns related to CodeMeter installer issues. Combine host telemetry with centralized logging for correlation.

---

Risk‑management and operational tradeoffs​

• Patch quickly but test carefully. Desigo CC and SENTRON are operational systems; blind, unscheduled updates can cause downtime during critical hours. Use a staged rollout: update non‑critical instances first, validate, then widen the update. Maintain rollback plans and backups.
• When a vendor supplies a component fix (CodeMeter runtime) but not a full packaged product build, operators face an integration risk: replacing an embedded runtime may change behavior or require re‑licensing. Test license‑import/export workflows and keep a fallback plan to the original state until a validated update process is in place. Siemens’ ProductCERT notes the need to follow product manuals and operational industrial security guidance when applying updates.
• For systems that cannot be patched (out‑of‑maintenance SKUs), rely on compensating controls: strict network segmentation, deny‑by‑default egress rules (block SOCKS5), jump hosts with MFA, and limiting which operator workstations can talk to device management APIs. Siemens and CISA emphasize isolating control system networks from business networks and minimizing exposure to the internet. ([cisa.gov](Siemens Desigo CC Product Family and SENTRON Powermanager | CISA= supply‑chain vulnerabilities like this are hard to manage
• The CodeMeter problem is a classic example of a supply‑chain vulnerability: a widely reused third‑party component (CodeMeter, which itself bundles network libraries) is embedded across many vendor products. A single upstream fix (e.g., libcurl 8.4.0) does not automatically propagate into all downstream vendor builds; each vendor must validate and repackage. That mismatch creates windows of exposure where devices remain exploitable even after upstream patches are available.
• Operational inertia in ICS/OT environments — long product lifecycles, change‑control overhead, and strict uptime requirements — increases the time to remediation. Attackers understand this and prioritize supply‑chain and embedded component attacks that yield persistent footholds. Robust asset management, bill‑of‑materials (SBOM) awareness, and tracked component versions are essential to close that gap.

---

Checklist for system owners (concise)​

• Inventory: list all Desigo CC and SENTRON Powermanager hosts and builds.
• Validate: map installed CodeMeter Runtime versions against WIBU advisory WIBU‑100120 and Siemens’ ProductCERT.
• Patch: install the fixed CodeMeter runtime or upgrade to Siemens‑provided fixed product builds. Restart hosts and verify license functionality.
• Block: restrict SOCKS5 outbound traffic and remove unneeded proxy environment variables.
• Monitor: enable EDR/IDS logging for suspicious proxy traffic, process crashes, and unexpected Explorer elevations.
• Document: record patch steps, checksums, and service restarts in change tickets for auditors and incident responders.

---

Strengths and limits of the vendor guidance — critical analysis​

• Strengths
• Siemens has published precise per‑product advisories and clear remediation steps (update CodeMeter runtime, or upgrade to a fixed product build). CISA’s republication adds weight and prescriptive steps for operators to follow. This coordinated disclosure approach is the right pattern for critical infrastructure vendors.
• WIBU published a clear advisory (WIBU‑100120) that explains the exploitability conditions and provides mitigations and installer options (PROP_CMCC flags, session restart), which helps operators plan safe installations.
• Limits and risks
• Patch scope and logistics: updating an embedded runtime inside a large operational product often requires packaging, validation and possibly re‑certification in production environments. Siemens’ advisories correctly point to product‑specific remediation tables, but operators still face a practical integration burden.
• Detection difficulty: libcurl vulnerabilities may be triggered only under narrow conditions (slow handshakes, specific proxy settings), making detection and deterministic proof of attempted exploitation difficult. That uncertainty favors cautious containment (deny SOCKS5 egress) while patches are rolled out.
• Out‑of‑maintenance devices: some older product lines may not receive updated builds; the operator must then accept compensating controls and the residual risk. Siemens discusses mitigation strategies for such cases, but those are inherently imperfect.

---

Longer‑term recommendations for industrial operators​

• Treat third‑party runtimes as first‑class assets. Maintain an SBOM for each deployed product and track which upstream libraries and their versions are embedded inside device images. This reduces the time between upstream disclosure and targeted remediation.
• Harden network posture for management planes:
• Strict segmentation between OT and IT
• Egress allow‑lists rather than broad egress permits
• Centralized jump hosts with MFA and comprehensive session logging for maintenance actions.
• Automate detection for suspicious proxy/handshake anomalies and integrate those alerts into incident response playbooks tailored to ICS: prioritize investigation of traffic that matches socks5 negotiation patterns coming from management servers.

---

Conclusion​

The Siemens advisories around Desigo CC and SENTRON Powermanager underscore two perennial truths for industrial cybersecurity: first, that third‑party components can be the weak link even in carefully engineered enterprise products; and second, that timely, tested remediation plus sensible compensating controls are essential to contain risk in OT environments. Siemens and WIBU have released actionable fixes and procedures — the immediate operational imperative is rapid inventory, prioritized patching of CodeMeter Runtime (or product upgrades where provided), and network controls to reduce exploitability windows. Follow Siemens’ product‑specific remediation tables, apply the WIBU fixes where required, and treat SOCKS5 proxy usage as a high‑risk protocol until your estate is verified patched.

---

---

Source: CISA Siemens Desigo CC Product Family and SENTRON Powermanager | CISA