CVE-2011-5007
3S CoDeSys < 3.4 - Remote Code Execution via Long URI to CmpWebServer
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-5007.
PoCs published by Metasploit, Celil Ünüver, Luigi Auriemma, Celil UNUVER, including Metasploit module exploits/windows/scada/codesys_web_server.
AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in CoDeSys SCADA Web Server v1.1.9.9 via a maliciously crafted HTTP GET request. It achieves remote code execution by overwriting the return address with a JMP ESP instruction and executing shellcode.
Description
Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080.
Exploits (3)
This Metasploit module exploits a stack buffer overflow in CoDeSys SCADA Web Server v1.1.9.9 via a maliciously crafted HTTP GET request. It achieves remote code execution by overwriting the return address with a JMP ESP instruction and executing shellcode.
This exploit targets a remote buffer overflow in CoDeSys v2.3 webserver, sending a crafted HTTP GET request with a malicious payload to achieve remote code execution. It includes shellcode and a reverse shell connection to port 4444.
This Metasploit module exploits a stack buffer overflow in CoDeSys Web Server versions 3.4 SP4 Patch 2 and earlier, allowing remote code execution via a crafted HTTP GET request. It includes two targets for different CoDeSys versions and leverages a JMP ESP or memcpy technique to bypass stack protections.