Vendors Affected by Wibu CodeMeter Vulnerabilities

CVE-2025-41450

CWE 287: Improper Authentication
An Improper Authentication vulnerability exists in Danfoss AK-SM8xxA Series, resulting in an authentication bypass. Install the latest patch with number 4.2 to remediate this vulnerability. This flaw could enable an attacker to generate a web report that discloses sensitive information such as internal IP addresses, usernames, store names, and other sensitive information.e

CVSS v3: 8.2

CVE-2025-4041

CWE-798 USE OF HARD-CODED CREDENTIALS:

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.

Optigo Networks recommends users implement at least one of the following additional mitigations:

• Use a dedicated NIC on the BMS computer and exclusively use the computer for connecting to OneView to manage your OT network configuration.
• Set up a router firewall with a white list for the devices permitted to access OneView.
• Connect to OneView via secure VPN.

CVSS v3: 9.8

CVE-2025-3128

CWE-78 Improper Neutralization of Special Elements used in an OS Command:

A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the product.

Mitsubishi Electric Europe B.V. recommends that users take note of the following mitigation measures to minimize the risk of exploiting this vulnerability:

• Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Use web application firewall (WAF) to prevent to filter, monitor and block any malicious HTTP/HTTPS traffic.
• Allow web client access from trusted networks only.

CVSS v3: 9.8

CVE-2025-3232

CWE-306: Missing Authentication for Critical Function:

A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.

Mitsubishi Electric Europe B.V. recommends that users take note of the following mitigation measures to minimize the risk of exploiting this vulnerability:

• Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Use web application firewall (WAF) to prevent to filter, monitor and block any malicious HTTP/HTTPS traffic.
• Allow web client access from trusted networks only.

CVSS v3: 7.5

CVE-2025-2081

CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.

Optigo Networks recommends users to upgrade to the following:

• Visual BACnet Capture Tool: Version v3.1.3rc8
• Optigo Visual Networks Capture Tool: Version v3.1.3rc8

CVSS v3: 7.5