ICS-Advisories

Risk Evaluation

The TRUMPF product versions listed below include a Wibu CodeMeter Runtime version that contains several vulnerabilities, e.g. potentially allowing privilege escalation.

Zusammenfassung der Gegenmaßnahmen

An updated Wibu Codemeter Runtime is available for download. If your installation is affected, the easiest fix is to install the latest Runtime from https://www.wibu.com/support/user/user-software.html

Risk Evaluation

The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.

Zusammenfassung der Gegenmaßnahmen

New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from https://www.trumpf.com/en_INT/products/software/software-licensing/. | Fixed Product | Version | | --------------------- | -------- | | TruTops Boost | 21.00.00 | | TecZone Bend | 25.11.1 | | Oseon | 8.00.00 | | Programming Tube | 6.9 | | TruTops Cell | 2.77.0 | | TruTops Weld | 11.0 | | TRUMPF License Expert | 2.3.2 |

Risk Evaluation

TruControl laser control software from versions 2.14.0 to 3.14.0 use sudo versions affected by CVE-2021-3156. The affected sudo has a heap-based buffer overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Zusammenfassung der Gegenmaßnahmen

- Update to TruControl version 3.16.0 or higher or - Please contact your service partner (service.tls@trumpf.com) for instructions on how to retrieve the patch

Risk Evaluation

The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.

Zusammenfassung der Gegenmaßnahmen

Since August 8st, 2025, an automated configuration update is available for TRUMPF machines with a Telepresence Box 7.0.0 and newer. It will automatically be applied when activating a remote session from the machine. It is not necessary for a TRUMPF technician to join the session.

Risk Evaluation

Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer underflow vulnerability in 7-zip versions up to and including 22.x This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access to, change of data or disruption of the whole service.

Zusammenfassung der Gegenmaßnahmen

Please download the replacement tool. For additional questions please contact your TRUMPF Service with the PR number 501709.

Risk Evaluation

The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF recommends mitigation of thisvulnerability.When editing a specially crafted file containing UTF-8 characters in Notepad++ (Versions up to 8.5.6) and converting that file to UTF-16, a buffer overflow vulnerability can be exploited that allows an attacker to execute arbitrary code to take over the whole system.

Zusammenfassung der Gegenmaßnahmen

For additional questions please contact your TRUMPF Service with the PR number 501709.

Risk Evaluation

The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE (External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked into loading externally hosted, potentially malicious XML code and possibly executing it. This vulnerability allows for the execution of remote XML code, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.

Zusammenfassung der Gegenmaßnahmen

New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

Risk Evaluation

TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable  X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.

Zusammenfassung der Gegenmaßnahmen

Securing the access to the production network. Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the new major release 3.42.0 of the new TruControl software version.

Risk Evaluation

A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.

Zusammenfassung der Gegenmaßnahmen

- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.

Risk Evaluation

TruControl laser control software prior to version 1.60.0 uses an OpenSSH server version affected by CVE-2024-6387. The affected OpenSSH Server version could potentially lead to a remote code execution.

Zusammenfassung der Gegenmaßnahmen

Update to first fixed version 1.06.00 or ideally to the newest release 04.04.00

Risk Evaluation

TruControl laser control software from versions 3.50.0 to 4.00.0.B use Linux kernel versions affected by CVE-2024-1086. The affected kernel vulnerability could lead to local privilege escalation.

Zusammenfassung der Gegenmaßnahmen

• Update to the new release 4.04.0 of the TruControl software version

Risk Evaluation

The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60d) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes these vulnerabilities is available.

Zusammenfassung der Gegenmaßnahmen

CVE-2023-38545 only appears when used together with a SOCKS-5 Proxy. Not using theaffected products via a SOCKS-5 proxy mitigates the vulnerability.

Risk Evaluation

Multiple vulnerabilities in the included versions of OpenSSL can lead to different problems, including crashes of the OpenSSL modules (leading to a Denial of Service) or leakage of plaintext. These underlying vulnerabilities can be fixed by installing a software update provided by TRUMPF.

Zusammenfassung der Gegenmaßnahmen

Please contact your TRUMPF Service with the PR number 500876.

Risk Evaluation

The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60b) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes this vulnerability is available.Machines with a running and correctly installed mGuard hardware firewall cannot be exploited by this vulnerability if used as intended (according to the manual). Update A, 2023-11-13 Removed CVE-2023-4701 because it was revoked.

Zusammenfassung der Gegenmaßnahmen

Implement general security best practices like network segmentation, endpoint protection and system hardening. Restrict network access to the TRUMPF License Expert server component to required clients only by using firewalls or other suitable products.

Risk Evaluation

During the installation of specific TRUMPF Windows applications, privileged local users with default usernames and passwords are created. An adversary could use these users to access and compromise the affected Windows systems and, under certain circumstances, other network resources.

Zusammenfassung der Gegenmaßnahmen

Please contact your TRUMPF Service with the PR number 496330.

Risk Evaluation

A number of TRUMPF software tools use the OPC UA Server in C++ based OPC UA SDK by Unified Automation. The application contains several vulnerabilities, which enable an attacker to send malicious data to the application, resulting in a Denial-of-Service.

Zusammenfassung der Gegenmaßnahmen

Use the updated versions of the TRUMPF OPC UA server that will be available via MyTRUMPF.

Risk Evaluation

A service function in the stated TRUMPF products is exposed without necessary authentication. Execution of this function may result in unauthorized access to, change of data or disruption of the whole service.

Zusammenfassung der Gegenmaßnahmen

Use the updated versions of the TRUMPF products that will be available via your service channel shortly or the hotfix, on following link: https://files.trumpf.com/w/LmhlkCA74heAIdS4GvJDDHqirMU0dpXbTRr7Erw8CXBvQ

Risk Evaluation

The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs: **CVE list:** - CVE-2021-29242 - CVE-2021-29241 - CVE-2019-5105 - CVE-2020-7052 - CVE-2019-9012 - CVE-2019-9010 - CVE-2019-9009 - CVE-2018-10612 In addition to the CVEs listed above, the affected products are also vulnerable to the following issues without a CVE ID: --- ### **CODESYS Advisory 2018-07** A crafted communication request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition. - **CVSS v3.0 base score:** 6.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` 🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12928&token=6d1dcea05a15aeef7ad48eadc64c8eca5d4f07b2&download=) --- ### **CODESYS Advisory 2018-04** The CODESYS runtime system allows access to files outside the restricted working directory of the controller by online services. - **CVSS v3.0 base score:** 9.9 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` 🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12925&token=50e7240fa947ea215311e3db441f82152f1109b6&download=) --- ### **CODESYS Advisory 2017-03** A crafted request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition. - **CVSS v3.0 base score:** 7.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` 🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12912&token=2f23e7f047c2768dd06fdf072de49a7ba1fe9687&download=)

Zusammenfassung der Gegenmaßnahmen

- We highly recommend updating to TruControl version 3.16.0 or higher as soon as possible - Please contact your service partner (service.tls@trumpf.com) for immediate instructions on how to retrieve the update