CVE-2024-24947 Overview
CVE-2024-24947 is a heap-based buffer overflow [CWE-787] in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E firmware version 1.2.10.9. The flaw allows an unauthenticated attacker to send a specially crafted network packet that triggers heap corruption and causes denial of service. The corruption occurs at offset 0xb68c4 of the firmware, where a call to memset uses an attacker-controlled length value and overwrites trailing heap allocations. The vulnerability affects several AutomationDirect Productivity series programmable logic controllers (PLCs) used in industrial control system (ICS) environments.
Critical Impact
Unauthenticated remote attackers can corrupt heap memory on affected PLCs through a single crafted network packet, producing denial of service in operational technology environments.
Affected Products
- AutomationDirect P3-550E firmware versions 1.2.10.9 and 4.1.1.10
- AutomationDirect P3-550 and P3-530 firmware versions 1.2.10.9 and 4.1.1.10
- AutomationDirect P2-550, P1-550, and P1-540 firmware versions 1.2.10.10 and 4.1.1.10
Discovery Timeline
- 2024-05-28 - CVE-2024-24947 published to NVD
- 2025-02-12 - Last updated in NVD database
Technical Details for CVE-2024-24947
Vulnerability Analysis
The vulnerability resides in the Programming Software Connection feature exposed by the PLC over the network. When the device parses a CurrDir request, it reaches a memset call at firmware offset 0xb68c4 that uses an attacker-controlled length parameter. Because the length is not validated against the destination buffer size on the heap, the memset writes past the allocation boundary and corrupts adjacent heap chunks. The result is structural damage to heap metadata and any trailing allocations, which destabilizes the firmware runtime and produces a denial of service. The flaw is classified as an out-of-bounds write [CWE-787].
Root Cause
The root cause is missing bounds validation on a length field sourced from network input. The firmware trusts the supplied size and passes it directly to memset, treating an attacker-controlled value as a safe buffer length. No prior check confirms the destination heap allocation is large enough to receive the write.
Attack Vector
The vulnerability is reachable over the network and requires no authentication or user interaction. An attacker with network access to the PLC's programming interface sends one crafted packet that targets the CurrDir handler. Successful exploitation crashes the device or destabilizes its control logic, disrupting any industrial process the PLC manages.
No verified public proof-of-concept code is available. For technical specifics, see the Talos Intelligence Vulnerability Report TALOS-2024-1937.
Detection Methods for CVE-2024-24947
Indicators of Compromise
- Unexpected reboots, watchdog resets, or process halts on AutomationDirect Productivity series PLCs
- Inbound traffic to the Programming Software Connection service from hosts that are not authorized engineering workstations
- Malformed or oversized CurrDir requests targeting the PLC management protocol
Detection Strategies
- Deploy ICS-aware network intrusion detection signatures that inspect AutomationDirect programming protocol traffic for malformed length fields
- Baseline normal engineering workstation-to-PLC communication patterns and alert on deviations in source, frequency, or payload size
- Capture and review PLC diagnostic logs for repeated crash or restart events that correlate with external network activity
Monitoring Recommendations
- Enable continuous packet capture on segments hosting Productivity series PLCs for forensic review after suspected incidents
- Monitor SCADA and historian data for unexpected loss-of-communication events with affected controllers
- Forward network telemetry from OT segments into a centralized analytics platform for correlation with IT-side threat data
How to Mitigate CVE-2024-24947
Immediate Actions Required
- Inventory all AutomationDirect P1-540, P1-550, P2-550, P3-530, P3-550, and P3-550E devices and identify firmware versions 1.2.10.9, 1.2.10.10, and 4.1.1.10
- Restrict network access to the PLC programming port using firewall rules that allow only known engineering workstations
- Place affected controllers behind an OT demilitarized zone (DMZ) and block all programming traffic from corporate or external networks
Patch Information
Review the Talos Intelligence Vulnerability Report TALOS-2024-1937 for vendor coordination details and consult AutomationDirect directly for firmware updates that address the CurrDir handler. Apply any released firmware to all affected Productivity series controllers after testing in a maintenance window.
Workarounds
- Segment PLCs onto dedicated OT VLANs with strict ingress filtering until patched firmware is applied
- Disable or block the Programming Software Connection service when not actively used for engineering changes
- Require operators to connect engineering workstations through a jump host with multi-factor authentication before reaching the PLC network
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
