Most recent entries from csaf_trumpfsecokg

VDE-2026-091 — TRUMPF: Multiple products affected by Wibu CodeMeter vulnerabilities

Tue, 15 Sep 2026 07:00:00 +0000

The TRUMPF product versions listed below include a Wibu CodeMeter Runtime version that contains several vulnerabilities, e.g. potentially allowing privilege escalation.

VDE-2026-007 — TRUMPF: Multiple products affected by Wibu CodeMeter vulnerability

Mon, 23 Feb 2026 08:00:00 +0000

The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.

VDE-2021-011 — TRUMPF Laser GmbH: TruControl 2.14.0 to 3.14.0 affected by recent sudo vulnerability

Mon, 22 Mar 2021 08:59:00 +0000

TruControl laser control software from versions 2.14.0 to 3.14.0 use sudo versions affected by CVE-2021-3156. The affected sudo has a heap-based buffer overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

VDE-2025-078 — TRUMPF: Remote support uses an outdated encryption algorithm

Mon, 25 Aug 2025 06:00:00 +0000

The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.

VDE-2024-005 — TRUMPF: Multiple products contain vulnerable version of 7-zip

Tue, 23 Jan 2024 07:00:00 +0000

Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer underflow vulnerability in 7-zip versions up to and including 22.x

This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access to, change of data or disruption of the whole service.

VDE-2024-004 — TRUMPF: Multiple products affected by log4net vulnerability

Tue, 22 Apr 2025 10:00:00 +0000

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

VDE-2024-003 — TRUMPF: Multiple products include a vulnerable version of Notepad++

Tue, 23 Jan 2024 07:00:00 +0000

The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF recommends mitigation of thisvulnerability.When editing a specially crafted file containing UTF-8 characters in Notepad++ (Versions up to 8.5.6) and converting that file to UTF-16, a buffer overflow vulnerability can be exploited that allows an attacker to execute arbitrary code to take over the whole system.

VDE-2022-049 — TRUMPF: Multiple products prone to X.Org server vulnerabilities

Mon, 07 Nov 2022 11:43:00 +0000

TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.

VDE-2020-039 — TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities

Tue, 27 Oct 2020 10:28:00 +0000

A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.

VDE-2024-040 — Multiple TRUMPF products prone to regreSSHion OpenSSH server vulnerabilities

Tue, 25 Jun 2024 10:00:00 +0000

TruControl laser control software prior to version 1.60.0 uses an OpenSSH server version affected by CVE-2024-6387. The affected OpenSSH Server version could potentially lead to a remote code execution.