CVE-2024-23601: AutomationDirect P3-550E RCE Vulnerability

CVE-2024-23601 Overview

A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect Productivity Series programmable logic controllers (PLCs). This vulnerability allows an attacker to achieve arbitrary code execution by providing a specially crafted scan_lib.bin file to affected devices. The vulnerability stems from insufficient validation of data integrity (CWE-345) and improper neutralization of special elements used in code (CWE-94), enabling attackers to inject and execute malicious code on industrial control systems.

Critical Impact

Successful exploitation allows complete compromise of industrial control systems through arbitrary code execution, potentially affecting critical infrastructure operations.

Affected Products

• AutomationDirect P3-550E Firmware (versions 1.2.10.9 and 4.1.1.10)
• AutomationDirect P3-550 Firmware (versions 1.2.10.9 and 4.1.1.10)
• AutomationDirect P3-530 Firmware (versions 1.2.10.9 and 4.1.1.10)
• AutomationDirect P2-550 Firmware (versions 1.2.10.10 and 4.1.1.10)
• AutomationDirect P1-550 Firmware (versions 1.2.10.10 and 4.1.1.10)
• AutomationDirect P1-540 Firmware (versions 1.2.10.10 and 4.1.1.10)

Discovery Timeline

• 2024-05-28 - CVE-2024-23601 published to NVD
• 2025-02-12 - Last updated in NVD database

Technical Details for CVE-2024-23601

Vulnerability Analysis

This code injection vulnerability affects the scan_lib.bin file handling mechanism in AutomationDirect Productivity Series PLCs. The vulnerability was identified by Cisco Talos and tracked as TALOS-2024-1943. The flaw combines insufficient verification of data authenticity (CWE-345) with code injection weaknesses (CWE-94), creating a dangerous attack surface in industrial environments.

The vulnerability is particularly concerning for operational technology (OT) environments where PLCs control physical processes. An attacker who can deliver a malicious scan_lib.bin file to the device can execute arbitrary code with the privileges of the PLC firmware, potentially taking complete control of the industrial control system.

Root Cause

The root cause of this vulnerability lies in insufficient validation of the scan_lib.bin file before it is processed by the PLC firmware. The affected devices fail to properly verify the integrity and authenticity of the scan library binary, allowing specially crafted malicious files to be loaded and executed. This represents a fundamental failure in input validation for files that are processed by the PLC's execution environment.

Attack Vector

The attack can be conducted over the network without requiring authentication or user interaction. An attacker must have network access to the affected PLC and the ability to provide a malicious scan_lib.bin file. This could be accomplished through:

The vulnerability affects the scan library functionality, which is a core component of the PLC's operation. When a specially crafted scan_lib.bin file is provided to the device, the malicious code embedded within the file is executed by the PLC firmware. The attack does not require any privileges or user interaction, making it highly exploitable in environments where network access to PLCs is available. Attack scenarios include compromised engineering workstations, network-based file transfer attacks, or supply chain compromises where malicious scan library files are distributed.

Detection Methods for CVE-2024-23601

Indicators of Compromise

• Unexpected modifications to scan_lib.bin files on affected PLCs
• Unusual network traffic to or from Productivity Series PLCs on non-standard ports
• Unauthorized changes to PLC configurations or program logic
• Anomalous process execution or memory usage patterns on PLC devices

Detection Strategies

• Monitor file transfers to PLCs, specifically watching for scan_lib.bin uploads from unauthorized sources
• Implement integrity monitoring for PLC firmware and configuration files using cryptographic hashes
• Deploy network-based intrusion detection systems with signatures for known exploitation patterns targeting AutomationDirect devices
• Establish baselines for normal PLC network behavior and alert on deviations

Monitoring Recommendations

• Enable detailed logging on engineering workstations and network infrastructure connecting to PLCs
• Implement network segmentation monitoring between IT and OT environments
• Deploy SentinelOne Singularity for endpoint protection on engineering workstations that manage PLCs
• Use industrial-specific monitoring solutions to track changes to PLC programs and configurations

How to Mitigate CVE-2024-23601

Immediate Actions Required

• Review the AutomationDirect Security Advisory SA00039 for vendor-specific guidance
• Isolate affected PLCs from untrusted networks immediately
• Audit and verify integrity of all scan_lib.bin files currently deployed on affected devices
• Restrict network access to affected PLCs to only authorized engineering workstations

Patch Information

AutomationDirect has released information regarding this vulnerability. Organizations should consult the AutomationDirect Security Advisory for specific firmware updates and remediation guidance. Affected firmware versions include 1.2.10.9, 1.2.10.10, and 4.1.1.10 across the Productivity Series PLC product line. Contact AutomationDirect support for the latest secure firmware versions.

Workarounds

• Implement strict network segmentation to isolate PLCs from general network access
• Deploy application whitelisting on engineering workstations to prevent unauthorized file transfers
• Establish file integrity verification procedures for all scan library files before deployment
• Use VPNs and firewall rules to restrict access to PLC management interfaces to authorized personnel only

# Network isolation example - restrict PLC access to authorized engineering subnet
# Replace IP addresses with your specific network configuration
iptables -A INPUT -s 10.100.50.0/24 -d 192.168.10.0/24 -p tcp --dport 502 -j ACCEPT
iptables -A INPUT -d 192.168.10.0/24 -p tcp --dport 502 -j DROP