CVE-2020-37017 - CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path

Back Back to CVE browser

HIGH

CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path

Published Jan 29, 2026

8.5

HIGH

CVSS 4.0

EPSS 0.14%

Description

CodeMeter 6.60 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the CodeMeter Runtime Server service to inject malicious code that would execute with LocalSystem permissions.

Affected products

Vendor Wibu Product CodeMeter Default
unaffected
- Version
  6.60
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wibu

CodeMeter

unaffected

Version	Status	Constraints
6.60	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-428

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30921
Advisory
https://www.exploit-db.com/exploits/48735
exploit
https://www.vulncheck.com/advisories/codemeter-codemeterexe-unquoted-service-path
third-party-advisory
https://www.wibu.com/us/products/codemeter/runtime.html
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30921		Advisory
https://www.exploit-db.com/exploits/48735		exploit
https://www.vulncheck.com/advisories/codemeter-codemeterexe-unquoted-service-path		third-party-advisory
https://www.wibu.com/us/products/codemeter/runtime.html		product