CVE-2021-20093: Siemens Pss Cape

Critical severity, CVSS 9.1. EPSS: 33.3% chance of exploitation in the next 30 days.

A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.

Affected products

• Siemens Pss Cape: affected versions not specified
• Siemens Sicam 230 Firmware: any version
• Siemens SIMATIC Information Server: version 2019 only; version 2020 only
• Siemens SIMATIC Pcs Neo: before 3.1 (fixed in 3.1)
• Siemens SIMATIC Process Historian: from 2019, before 2020 (fixed in 2020); version 2020 only
• Siemens SIMATIC Wincc Oa: version 3.17 only; version 3.18 only
• Siemens Simit Simulation Platform: from 10.0, before 10.3 (fixed in 10.3); version 10.3 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1); version 1.0.1 only
• Siemens Sinema Remote Connect Server: before 3.0 (fixed in 3.0); version 3.0 only
• Wibu Codemeter: up to and including 7.21a

Published 2021-06-16. Last modified 2026-06-17.