CVE-2024-24946 Overview
CVE-2024-24946 is a heap-based buffer overflow vulnerability in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E firmware version 1.2.10.9. An unauthenticated attacker can send a specially crafted network packet to corrupt heap memory and trigger a denial-of-service condition on the affected programmable logic controller (PLC). The flaw is tracked as a [CWE-787] out-of-bounds write and affects multiple AutomationDirect Productivity Series controllers used in industrial automation environments.
Critical Impact
Remote unauthenticated attackers can crash AutomationDirect Productivity Series PLCs over the network, disrupting industrial control processes that depend on these devices.
Affected Products
- AutomationDirect P3-550E firmware 1.2.10.9 and 4.1.1.10
- AutomationDirect P3-550 and P3-530 firmware 1.2.10.9 and 4.1.1.10
- AutomationDirect P2-550, P1-550, and P1-540 firmware 1.2.10.10 and 4.1.1.10
Discovery Timeline
- 2024-05-28 - CVE-2024-24946 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24946
Vulnerability Analysis
The vulnerability resides in the Programming Software Connection service that AutomationDirect Productivity Series PLCs expose over the network. When the device processes a CurrDir (current directory) request, the firmware calls memset using a length value supplied by the attacker. Because the length is not validated against the size of the destination heap allocation, the memset operation writes past the end of the buffer and corrupts trailing heap chunks. According to the Talos advisory, the heap corruption occurs at offset 0xb686c in firmware version 1.2.10.9. Successful exploitation forces the PLC into an inoperable state and requires physical or administrative intervention to restore control system functionality.
Root Cause
The root cause is missing bounds validation on an attacker-controlled length parameter passed to a memory write primitive. The firmware trusts the size field embedded in the incoming network packet and uses it directly as the count argument to memset, allowing arbitrary heap metadata and adjacent allocations to be overwritten.
Attack Vector
The attack vector is fully remote and unauthenticated. An adversary with network reachability to the PLC's Programming Software Connection port sends a single crafted packet containing a malicious CurrDir payload. No user interaction or prior authentication is required. The integrity and availability impacts mean attackers can disrupt physical processes controlled by the PLC.
Verified exploitation code is not publicly available. See the Talos Intelligence Vulnerability Report TALOS-2024-1937 for technical reproduction details.
Detection Methods for CVE-2024-24946
Indicators of Compromise
- Unexpected reboots, watchdog resets, or fault states on AutomationDirect Productivity Series PLCs.
- Loss of communication between engineering workstations and the PLC Programming Software Connection service.
- Inbound traffic to the Programming Software Connection port from hosts outside the engineering workstation allowlist.
Detection Strategies
- Monitor industrial network segments for malformed packets targeting the AutomationDirect Programming Software Connection protocol.
- Deploy network intrusion detection signatures that flag oversized or anomalous CurrDir length fields.
- Correlate PLC availability alerts from SCADA historians with network traffic captures to identify potential exploitation attempts.
Monitoring Recommendations
- Enable continuous packet capture at the OT/IT boundary in front of Productivity Series controllers.
- Forward PLC diagnostic logs and SCADA alarm events to a centralized SIEM for cross-correlation.
- Baseline normal engineering workstation communication patterns and alert on deviations to PLC management ports.
How to Mitigate CVE-2024-24946
Immediate Actions Required
- Restrict network access to the Programming Software Connection service so only authorized engineering workstations can reach the PLC.
- Place affected AutomationDirect controllers behind a properly configured industrial firewall or data diode.
- Audit firmware inventory and identify all P3-550E, P3-550, P3-530, P2-550, P1-550, and P1-540 devices running affected versions.
Patch Information
Review the Talos Intelligence Vulnerability Report TALOS-2024-1937 and contact AutomationDirect for the latest firmware that addresses CVE-2024-24946. Schedule firmware upgrades during planned maintenance windows because PLC updates typically require process downtime.
Workarounds
- Segment OT networks using firewalls or VLANs to block untrusted traffic from reaching PLC programming ports.
- Disable or block the Programming Software Connection service when programming activities are not in progress.
- Apply strict allowlists at the firewall to permit communication only from designated engineering hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
