Threat reportVulnerabilityTL-2026-5481

Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)

highPATCHED

Siemens advisory SSA-201595 reports that WIBU CodeMeter before 8.30a sometimes allows local privilege escalation immediately after installation. The same flaw also affects SIMATIC PDM Maintenance Station and SIMATIC WinCC OA (SSA-331739). No active exploitation, public PoC or CISA KEV listing is documented in the sources reviewed. First disclosed 2025-05-16.

Key facts for CodeMeter privilege escalation

Identifiers	TL-2026-5481, CVE-2025-47809
Also known as	WIBU-100120, SSA-201595, SSA-331739
Severity	HIGH
CVSS	8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
First disclosed	2025-05-16
Exploitation status	No exploitation observed (theoretical)
Affected products	Siemens Desigo CC Family (Desigo CC, Desigo CC Compact, Connect, Cerberus DMS); Siemens SENTRON Powermanager; Siemens SIMATIC PDM Maintenance Station; Siemens SIMATIC WinCC OA; Wibu-Systems CodeMeter Runtime (Windows)
Weaknesses (CWE)	CWE-272
MITRE ATT&CK techniques	T1078.003 Local Accounts, T1202 Indirect Command Execution, T1548 Abuse Elevation Control Mechanism
Motivation	UNKNOWN
Target sectors	building-automation, industrial-control-systems, energy, manufacturing, critical-infrastructure
Target regions	Global
Detection rules	9 (1 shown free)
Sources	7 cited sources

Detection coverage for CodeMeter privilege escalation

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5481 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CodeMeter Control Center Spawns Elevated Explorer (CVE-2025-47809) — Exploitation

Detects the CVE-2025-47809 exploitation step in WIBU CodeMeter Runtime < 8.30a: an unprivileged user reaches a privileged Windows Explorer from the CodeMeter Control Center Import License dialog, breaking out of the user's privilege boundary (UAC abuse, indirect command execution). Fires on a Sysmon process-creation event where explorer.exe runs at High or System integrity with CodeMeterCC.exe or CodeMeter.exe as its parent. Affected bundles include Siemens Desigo CC, SENTRON Powermanager, SIMATIC PDM Maintenance Station and WinCC OA (SSA-201595, SSA-331739). Exploitation is theoretical and no public PoC is documented, so treat hits as high-priority review. The parent/child relationship is inferred from the advisory text and should be validated in a lab.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1068, T1548, T1548.002, T1202
Data sources: sysmon, Microsoft-Windows-Sysmon/Operational
Severity: high
Confidence: medium

Splunk SPL

```TL-2026-5481 CVE-2025-47809: elevated explorer.exe under CodeMeter Control Center```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\explorer.exe" (ParentImage="*\\CodeMeterCC.exe" OR ParentImage="*\\CodeMeter.exe") (IntegrityLevel="High" OR IntegrityLevel="System")
| table _time host User ParentImage ParentCommandLine Image CommandLine IntegrityLevel ProcessGuid

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "explorer.exe"
| where InitiatingProcessFileName in~ ("CodeMeterCC.exe", "CodeMeter.exe")
| where ProcessIntegrityLevel in~ ("High", "System")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel
| order by Timestamp desc

Sigma

title: Elevated Explorer Spawned By CodeMeter Control Center (CVE-2025-47809)
id: 3f6a1c52-8b7e-4d29-9a41-5c0e7d1b2a63
status: experimental
description: Detects explorer.exe running at High or System integrity with CodeMeterCC.exe or CodeMeter.exe as parent, the exploitation step of CVE-2025-47809 in WIBU CodeMeter Runtime before 8.30a (Siemens SSA-201595, SSA-331739).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-47809
  - https://cert-portal.siemens.com/productcert/html/ssa-201595.html
  - https://cert-portal.siemens.com/productcert/html/ssa-331739.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
  - attack.privilege-escalation
  - attack.defense-evasion
  - attack.t1068
  - attack.t1548
  - attack.t1548.002
  - attack.t1202
  - cve.2025-47809
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\explorer.exe'
    ParentImage|endswith:
      - '\CodeMeterCC.exe'
      - '\CodeMeter.exe'
    IntegrityLevel:
      - 'High'
      - 'System'
  condition: selection
falsepositives:
  - Administrator opening Explorer from CodeMeter Control Center during legitimate licence import
level: high

Known false positives:

Administrator legitimately importing a licence file through CodeMeter Control Center on an elevated session
Vendor support or commissioning staff working on engineering stations with admin rights

Tuning notes: Exclude known administrator accounts and sanctioned commissioning hosts. Prioritise events where User is a non-admin account or where the CodeMeter install is under 24 hours old. Validate the exact parent process name on a test host with CodeMeter < 8.30a, since the privileged Explorer may be launched via a shell broker. Requires Sysmon EventCode 1 with IntegrityLevel collection.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

CodeMeter Control Center Creates Explorer Process (Defender / Security 4688) — Exploitation · unlock with TL Creds
Unexpected Child Process Of CodeMeter Control Center — Post-Exploitation · unlock with TL Creds
Persistence Actions On Hosts With CodeMeter Elevated Explorer (Service, Local Account, Run Key) — Post-Escalation · unlock with TL Creds
Elevated Explorer Spawned By CodeMeter Control Center (Sigma) — Exploitation · unlock with TL Creds
Command Interpreter Child Of CodeMeter Control Center (Sigma) — Post-Exploitation · unlock with TL Creds
CodeMeter Version Reconnaissance For Local Privilege Escalation (Sigma) — Discovery · unlock with TL Creds
CodeMeter Control Center Elevated Explorer Followed By Command Shell — Post-Exploitation · unlock with TL Creds
Unprivileged CodeMeter Runtime Installation (CVE-2025-47809 Precondition) · unlock with TL Creds

Indicators of compromise for CodeMeter privilege escalation

As of 2026-11-07, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5481.

7 indicators of compromise · unlock with TL Creds. Compare plans

How CodeMeter privilege escalation works

CVE-2025-47809 is a local privilege escalation weakness in the WIBU CodeMeter Runtime for Windows (before 8.30a), classified as CWE-272 (Least Privilege Violation). Siemens bundles the CodeMeter runtime with several industrial and building-automation products, so the flaw is inherited by Desigo CC (V5.0, V5.1, V6, V7 and V8 before V8.0 QU2, including the Compact, Connect and Cerberus DMS variants) and SENTRON Powermanager (V5 to V8 before V8.0 QU2). A separate Siemens advisory, SSA-331739, lists SIMATIC PDM Maintenance Station V5.0 (before SP2) and SIMATIC WinCC OA V3.18, V3.19 and V3.20 (before P032, P020 and P008) as affected by the same CVE.

The issue is only reachable in a narrow window. CodeMeter must have been installed without administrative privileges (unprivileged installation) with UAC enabled, and the CodeMeter Control Center component must be present and not yet restarted, meaning no logoff or reboot has happened since installation. In that state, an unprivileged local user can navigate from the Control Center Import License function to a privileged instance of Windows Explorer, which breaks out of the user's privilege boundary. The published description does not detail further post-exploitation steps.

The CVSS v3.1 vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.2 HIGH) with a changed scope. The attack vector is local and no network exploitation path is described. The sources reviewed do not mention active exploitation, a public proof of concept, or a CISA KEV entry. Researcher credit is not identified in the sources reviewed. The NVD entry lists the CVE as published in May 2025. Siemens published SSA-331739 on 2025-08-12 and SSA-201595 on 2025-08-14.

Remediation per Siemens: uninstall previous CodeMeter versions via Control Panel, install WIBU CodeMeter User Runtime V8.30a or later, and restart the client or server. For Desigo CC and SENTRON Powermanager V8, update to V8.0 QU2 or later. Siemens also recommends general industrial security measures such as restricting network access to affected systems. The WIBU Systems advisory WIBU-100120 is the vendor reference, but the page returned HTTP 403 during research and was not read directly.

MITRE ATT&CK techniques by tactic:

Remediation for CodeMeter privilege escalation

Patches

Desigo CC V8.0 QU2 or later
SENTRON Powermanager V8.0 QU2 or later
SIMATIC PDM Maintenance Station V5.0 SP2 or later
SIMATIC WinCC OA V3.18 P032, V3.19 P020, V3.20 P008 or later
WIBU CodeMeter Runtime V8.30a or later

Immediate actions

Uninstall existing CodeMeter via Control Panel, install WIBU CodeMeter User Runtime V8.30a or later, then restart client/server systems
Restart or log off every system where CodeMeter was recently installed without administrative privileges so the Control Center is restarted

Workarounds

Siemens documents no product-specific workaround beyond general mitigations: restrict network access and follow Industrial Security recommendations
Enforce a reboot or logoff immediately after any CodeMeter installation to close the exploitation window (per third-party vulnerability aggregator guidance)

Longer-term hardening

Follow Siemens Industrial Security operational guidelines and restrict network access to affected devices
Inventory bundled CodeMeter runtimes in Siemens engineering and building-automation stations and track their versions

Affected and fixed versions

Siemens — Desigo CC Family (Desigo CC, Desigo CC Compact, Connect, Cerberus DMS)
Vulnerable versions: V5.0 (all); V5.1 (all); V6 (all); V7 (all); V8 (< V8.0 QU2)
Fixed in: V8.0 QU2 or later
Siemens — SENTRON Powermanager
Vulnerable versions: V5 (all); V6 (all); V7 (all); V8 (< V8.0 QU2)
Fixed in: V8.0 QU2 or later
Siemens — SIMATIC PDM Maintenance Station
Vulnerable versions: V5.0 (< V5.0 SP2)
Fixed in: V5.0 SP2 or later
Siemens — SIMATIC WinCC OA
Vulnerable versions: V3.18 (< P032); V3.19 (< P020); V3.20 (< P008)
Fixed in: V3.18 P032; V3.19 P020; V3.20 P008 or later
Wibu-Systems — CodeMeter Runtime (Windows)
Vulnerable versions: < 8.30a
Fixed in: 8.30a or later

Timeline of CodeMeter privilege escalation

2025-05-14 CVE-2025-47809 disclosed for WIBU CodeMeter before 8.30a (third-party aggregators cite 14 May 2025; NVD lists publication on 16 May 2025)
2025-05-16 NVD publishes CVE-2025-47809 (CWE-272, CVSS v3.1 8.2 HIGH) and references WIBU-100120
2025-08-12 locked-ioc-7 publishes SSA-331739 covering SIMATIC PDM Maintenance Station V5.0 and SIMATIC WinCC OA V3.18/V3.19/V3.20
2025-08-14 locked-ioc-7 publishes SSA-201595 (V1.0) for Desigo CC family and SENTRON Powermanager
2025-08-19 locked-ioc-7 SSA-201595 revised to V1.1
2026-01-13 locked-ioc-7 SSA-201595 revised to V1.2
2026-03-10 locked-ioc-7 SSA-201595 revised to V1.3 (latest revision referenced); fixes available in Desigo CC / SENTRON Powermanager V8.0 QU2 and CodeMeter 8.30a or later

Sources cited for CodeMeter privilege escalation

Siemens Security Advisory SSA-201595 (last updated 2026-03-10) cert-portal.siemens.com · Advisory · 2025-08-14
Siemens Security Advisory SSA-331739 (SIMATIC PDM Maintenance Station / WinCC OA) cert-portal.siemens.com · Advisory · 2025-08-12
NVD - CVE-2025-47809 NVD (NIST) · Advisory · 2025-05-16
WIBU Systems Security Advisory WIBU-100120 (vendor advisory cited by NVD and Siemens; page not directly readable during research) wibu.com · Vendor report · 2025-05-14
SentinelOne Vulnerability Database - CVE-2025-47809 SentinelOne · Research
VulDB - Wibu CodeMeter up to 8.30 Control Center least privilege violation vuldb.com · Research
CVE-2025-47809 Information (James Brine) jamesbrine.com.au · Blog · 2025-05-17

Drafted by the Threadlinqs research pipeline from 7 sources; published 2026-11-07; last updated —.