CVE-2011-5009

🗓️ 25 Dec 2011 01:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 78 Views🌐 WEB

The CmpWebServer.dll module in the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted Content-Length in an HTTP POST or an invalid HTTP request method

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2011-5009	30 Nov 201100:00	–	circl
Check Point Advisories	Smart Software Solutions CoDeSys CmpWebServer Content-Length NULL Pointer (CVE-2011-5009)	14 Apr 201300:00	–	checkpoint_advisories
Cvelist	CVE-2011-5009	25 Dec 201101:00	–	cvelist
Exploit DB	CoDeSys 3.4 - POST Null Pointer Content-Length Parsing Remote Denial of Service	30 Nov 201100:00	–	exploitdb
Exploit DB	CoDeSys 3.4 - Null Pointer Invalid HTTP Request Parsing Remote Denial of Service	30 Nov 201100:00	–	exploitdb
ICS	3S CoDeSys Vulnerabilities	9 Oct 201206:00	–	ics
NVD	CVE-2011-5009	25 Dec 201101:55	–	nvd
OpenVAS	Codesys CmpWebServer Multiple Vulnerabilities	6 Dec 201100:00	–	openvas
Prion	Null pointer dereference	25 Dec 201101:55	–	prion
Positive Technologies	PT-2011-5164	25 Dec 201100:00	–	ptsecurity

NVD

Node

3ssoftware codesysMatch3.4sp4

Source	Link
osvdb	www.osvdb.org/77389
aluigi	www.aluigi.altervista.org/adv/codesys_1-adv.txt
osvdb	www.osvdb.org/77388
seclists	www.seclists.org/bugtraq/2011/Nov/178
secunia	www.secunia.com/advisories/47018
us-cert	www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/71533

Parameter	Position	Path	Description	CWE
request_method	path	/	DoS via NULL pointer dereference caused by an invalid HTTP request method to CmpWebServer.dll.
Content-Length	header	/	DoS via NULL pointer dereference caused by a crafted Content-Length in an HTTP POST to CmpWebServer.dll.

16 Jun 2026 23:35Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25

EPSS0.10395

cmpwebserver.dll 3s codesys denial of service null pointer dereference http post http request method cve-2011-5009 nvd