CVE-2026-81573: CWE-284 Improper Access Control in wibu-systems-ag codemeter-runtime

The vulnerability in CodeMeter Runtime before versions 8.41a or 9.10 arises from improper access control (CWE-284) in the configuration command handler when the software is configured as a server. It does not restrict commands based on network origin, allowing arbitrary remote peers to execute configuration commands. This flaw permits attackers to read sensitive configuration data and overwrite selected values in Server.ini, including the credential hash for the CodeMeter WebAdmin interface, which could lead to administrative takeover of the WebAdmin.

An attacker can remotely execute configuration commands without authentication or network origin restrictions, leading to disclosure of sensitive configuration data and modification of configuration files. This includes overwriting the WebAdmin credential hash, enabling potential administrative takeover of the WebAdmin interface. The vulnerability has a CVSS 3.1 score of 8.6 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality (low), integrity (high), and availability (low).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the CodeMeter Runtime server configuration interface to trusted hosts only and monitor for unauthorized access attempts. Avoid exposing the configuration command handler to untrusted networks.