CVE-2024-24954 Overview
CVE-2024-24954 is an out-of-bounds write vulnerability in the Programming Software Connection FileSystem API of the AutomationDirect P3-550E programmable logic controller (PLC), firmware version 1.2.10.9. Specially crafted network packets trigger heap-based memory corruption through an arbitrary null-byte write located at firmware offset 0xb69c8. An unauthenticated remote attacker can send malicious packets across the network to exploit this flaw [CWE-787]. Successful exploitation can corrupt heap memory, resulting in availability loss and partial integrity compromise on industrial control systems. Because the P3-550E is deployed in operational technology (OT) environments, exploitation can disrupt automation processes managed by the controller.
Critical Impact
Unauthenticated attackers can remotely trigger heap memory corruption on the P3-550E PLC, potentially causing denial of service in industrial environments.
Affected Products
- AutomationDirect P3-550E (hardware)
- AutomationDirect P3-550E Firmware version 1.2.10.9
- Systems using the Programming Software Connection FileSystem API
Discovery Timeline
- 2024-05-28 - CVE-2024-24954 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24954
Vulnerability Analysis
The vulnerability resides in the FileSystem API exposed by the P3-550E's Programming Software Connection service. The firmware fails to validate input bounds when processing network requests, allowing an attacker to write a null byte to an attacker-influenced location on the heap. This category of flaw is classified as an out-of-bounds write [CWE-787].
Null-byte writes in heap regions are particularly damaging because they can corrupt allocator metadata, function pointers, or string terminators stored in adjacent objects. The result is unpredictable program state that typically manifests as a crash but can, depending on heap layout, be leveraged for further attacks against the controller's runtime.
The EPSS score for this issue is 0.542%, placing it in the 41st percentile. AutomationDirect has not published a vendor advisory link in the NVD record, and no public exploit code has been released.
Root Cause
The firmware lacks proper boundary validation when handling fields parsed from FileSystem API network packets. At offset 0xb69c8 inside firmware 1.2.10.9, an attacker-controlled value is used as a write index without verifying that the resulting address falls within the intended buffer. The code then writes a null byte to that location, producing the out-of-bounds condition.
Attack Vector
Exploitation requires network reachability to the PLC's programming software service. No authentication or user interaction is required. An attacker on the same network segment, or any network path that exposes the device, crafts a malicious FileSystem API packet that drives the write index outside the intended buffer. The corrupted heap state typically halts or destabilizes the controller. Refer to the Talos Intelligence Vulnerability Report TALOS-2024-1938 for protocol-level technical details.
Detection Methods for CVE-2024-24954
Indicators of Compromise
- Unexpected reboots, watchdog resets, or runtime faults on P3-550E controllers running firmware 1.2.10.9.
- Unusual TCP sessions to the P3-550E programming software port originating from non-engineering workstations.
- Malformed or oversized FileSystem API requests captured in network telemetry directed at the PLC.
- Loss of communication between supervisory control and data acquisition (SCADA) systems and affected PLCs.
Detection Strategies
- Deploy ICS-aware deep packet inspection (DPI) to parse AutomationDirect programming protocol traffic and alert on malformed FileSystem API fields.
- Baseline normal engineering traffic to the PLC and alert on connections from unexpected source hosts.
- Correlate PLC fault events with concurrent network activity to identify exploitation attempts.
Monitoring Recommendations
- Forward PLC diagnostic logs and network flow data to a centralized SIEM for correlation.
- Monitor for repeated crash-and-restart cycles, a common signature of memory corruption probing.
- Track firmware versions across the fleet to identify devices still running 1.2.10.9.
How to Mitigate CVE-2024-24954
Immediate Actions Required
- Inventory all AutomationDirect P3-550E controllers and confirm firmware versions.
- Restrict network access to the PLC programming port using firewall rules or VLAN segmentation, allowing only authorized engineering workstations.
- Place affected PLCs behind an ICS-aware firewall or data diode where feasible.
- Contact AutomationDirect support to obtain remediation guidance specific to firmware 1.2.10.9.
Patch Information
No vendor patch URL is listed in the NVD record at the time of publication. Asset owners should consult AutomationDirect directly and reference the Talos Intelligence Vulnerability Report TALOS-2024-1938 for coordinated disclosure details and any available firmware updates beyond version 1.2.10.9.
Workarounds
- Isolate the P3-550E on a dedicated OT network segment with strict ingress filtering.
- Disable or block the Programming Software Connection service when active engineering changes are not in progress.
- Apply an allowlist on the upstream firewall permitting only known engineering workstation IP addresses to reach the PLC.
- Use a jump host with multi-factor authentication for any programming session targeting the controller.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
