CVE-2011-5058

The CmbWebserver.dll module of the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to create arbitrary directories under the web root by specifying a non-existent directory using \ (backslash) characters in an HTTP GET request.

• CWE-264

• http://aluigi.altervista.org/adv/codesys_1-adv.txtExploit
• http://secunia.com/advisories/47018Vendor Advisory
• http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdfUS Government Resource
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72339
• http://aluigi.altervista.org/adv/codesys_1-adv.txtExploit
• http://secunia.com/advisories/47018Vendor Advisory
• http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdfUS Government Resource
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72339

Published

Jan 10, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-5052Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 all…
• CVE-2011-5053The Wi-Fi Protected Setup (WPS) protocol, when the "external…
• CVE-2011-5054kcheckpass passes a user-supplied argument to the pam_start …
• CVE-2011-5055MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS da…
• CVE-2011-5056The authoritative server in MaraDNS through 2.0.04 computes …
• CVE-2011-5057Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides i…
• CVE-2011-5059Stack-based buffer overflow in Final Draft 8 before 8.02 all…
• CVE-2011-5060The par_mktmpdir function in the PAR module before 1.003 for…
• CVE-2011-5061functions.php in WHMCompleteSolution (WHMCS) 4.0.x through 5…
• CVE-2011-5062The HTTP Digest Access Authentication implementation in Apac…
• CVE-2011-5063The HTTP Digest Access Authentication implementation in Apac…
• CVE-2011-5064DigestAuthenticator.java in the HTTP Digest Access Authentic…