CVE-2017-13754: Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems Co...

Security readout for executives and security teams

This flaw lets a remote attacker store malicious script or HTML through the CodeMeter time-server configuration field. If an administrator later views the affected page, browser-side actions could occur in that user context. The public data names Wibu-Systems CodeMeter versions before 6.50b, but does not provide CVSS scoring or confirmed active exploitation. Exposure is most likely where Wibu-Systems CodeMeter administration interfaces are reachable by untrusted users or networks. Industrial environments using products that bundle CodeMeter should check Rockwell and ICS-CERT guidance, because the source bundle does not enumerate all downstream products. Handle as a moderate-priority hygiene and exposure-reduction item. The issue is old and public, with no KEV signal, but it can affect administrative interfaces in sensitive industrial or licensing environments if outdated CodeMeter instances remain reachable. Mitigation focus: Inventory systems running Wibu-Systems CodeMeter before 6.50b.; Review Wibu, Rockwell Automation, and ICS-CERT guidance for approved updates.; Upgrade CodeMeter where vendor guidance and product compatibility permit..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.