Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possi…

published 2011-12-25 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-4912

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 72.7%; EPSS 72.7% chance of exploitation in 30 days, percentile 99.4%
public exploits: 3; Metasploit, Exploit-DB

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-12-006-01 updated 2025-06-09 cvss 10.0

3S CoDeSys Vulnerabilities

3S Smart Software Solutions CoDeSys 2.3, 3.4
affected: mitigation

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-12-320-01 updated 2025-06-06 cvss 7.8

ABB AC500 PLC Webserver CoDeSys Vulnerability

ABB 1SAP130 300 R0271 PM573-ETH firmware__V2.1.3 ABB 1SAP140 300 R0271 PM583-ETH firmware__V2.1.3 ABB 1SAP150 000 R0271 PM590-ETH firmware__V2.1.3 ABB 1SAP150 100 R0271 PM591-ETH firmware__V2.1.3 ABB 1SAP150 200 R0271 PM592-ETH firmware__V2.1.3 ABB 1TNE968 900 R0110 PM554-T-ETH firmware__V2.1.3

+3 more productsfewer

ABB 1TNE968 900 R1110 PM564-T-ETH firmware__V2.1.3 ABB 1TNE968 900 R1210 PM564-R-ETH firmware__V2.1.3 ABB 1TNE968 900 R1211 PM564-R-ETH-AC firmware__V2.1.3

affected: mitigation

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

2011-12-01 First public exploit (EDB-18187)
2011-12-25 Published

Exploit prediction

72.71% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/scada/codesys_web_server SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow metasploit exploit, normal rank, 2011-12-02
EDB-18240 CoDeSys SCADA 2.3 - WebServer Stack Buffer Overflow (Metasploit) remote, 2011-12-13
EDB-18187 CoDeSys SCADA 2.3 - Remote Buffer Overflow remote, 2011-12-01

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

exploit-db.com /exploits/18187
exploit
secunia.com /advisories/47018
third-party-advisory, vendor-advisory
us-cert.gov /control_systems/pdf/ICS-ALERT-11-336-01A.pdf
us-government-resource
seclists.org /bugtraq/2011/Nov/178
mailing-list
aluigi.altervista.org /adv/codesys_1-adv.txt
osvdb.org /77387
vdb-entry
us-cert.gov /control_systems/pdf/ICS-ALERT-11-336-01.pdf
us-government-resource
ics-cert.us-cert.gov /advisories/ICSA-12-320-01

Sources

CVE List CVE-2011-5007
NVD CVE-2011-5007

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary