WIBU-100120: CodeMeter Windows Privilege Escalation Vulnerability

Critical Vulnerability Information Vulnerability Identifier WIBU-100120 Vulnerability Title Privilege Escalation through CodeMeter Installer on Windows CVSS Score CVSSv3.1 Base Score: 7.7 CVSSv3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Vulnerability Description Issue: A vulnerability exists in the CodeMeter Installer on Windows that allows privilege escalation under certain conditions from a non-privileged account. After installation, if the built-in Administrator account is used and User Account Control (UAC) is enabled, CodeMeter starts the CodeMeter Control Center with system privileges and retains those privileges until manually closed or the user logs off. Affected Products Affected Versions: CodeMeter Runtime = 8.30a Mitigation Measures 1. For existing installations, if the CodeMeter Control Center has been restarted at least once, no action is required. 2. For new installations, it is recommended to install CodeMeter Version 8.30a or later. 3. If an earlier version of CodeMeter must be installed, three mitigation methods are available: - Do not use the built-in Administrator account; instead, use a standard user account that is part of the Administrators group. - After installation with the current user account, terminate the CodeMeter Control Center. - End the session after installation (log off or restart Windows). Additional Information Reporter: Mateusz Giebliński Release Date: 2025-05-14T10:00:00.000Z

Goal Reached Thanks to every supporter — we hit 100%!

WIBU-100120: CodeMeter Windows Privilege Escalation Vulnerability