CVE-2024-24955 Overview
CVE-2024-24955 is an out-of-bounds write vulnerability in the Programming Software Connection FileSystem API of the AutomationDirect P3-550E programmable logic controller running firmware version 1.2.10.9. Specially crafted network packets trigger heap-based memory corruption through an arbitrary null-byte write at offset 0xb69fc in the firmware. An unauthenticated attacker on the network can send malicious packets to corrupt heap memory and disrupt controller operation. The flaw is classified as [CWE-787] (Out-of-bounds Write) and primarily impacts the availability of the industrial controller.
Critical Impact
Unauthenticated network attackers can trigger heap corruption on the P3-550E PLC, leading to denial of service of industrial control operations.
Affected Products
- AutomationDirect P3-550E PLC (hardware)
- AutomationDirect P3-550E firmware version 1.2.10.9
- Programming Software Connection FileSystem API component
Discovery Timeline
- 2024-05-28 - CVE-2024-24955 published to NVD
- 2025-02-12 - Last updated in NVD database
Technical Details for CVE-2024-24955
Vulnerability Analysis
The vulnerability resides in the Programming Software Connection FileSystem API exposed by the P3-550E firmware. The API parses network packets that direct file-system operations on the controller. Improper validation of attacker-controlled fields allows a write of a null byte (0x00) outside the bounds of an allocated heap buffer. The arbitrary null-byte write originates at firmware offset 0xb69fc. Corrupting heap metadata or adjacent objects produces unpredictable controller behavior and a high impact on availability. The integrity impact is limited because the primitive writes a single null byte rather than attacker-controlled data.
Root Cause
The root cause is missing bounds checking on an index or length field consumed by the FileSystem API handler. The handler computes a destination address using untrusted input from the network packet and writes a null terminator without verifying that the destination lies inside the allocated buffer. This is a textbook [CWE-787] flaw in C-based embedded firmware.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the PLC sends a crafted packet to the Programming Software Connection service. The malformed request triggers the out-of-bounds null-byte write during FileSystem API processing, corrupting heap memory in the controller.
No public proof-of-concept has been released. See the Talos Intelligence Vulnerability Report for the technical write-up describing the affected code path.
Detection Methods for CVE-2024-24955
Indicators of Compromise
- Unexpected restarts, watchdog resets, or fault states reported by the P3-550E controller
- Loss of communication with the PLC during or after Programming Software Connection sessions from unknown hosts
- Anomalous TCP sessions from non-engineering workstations targeting the Programming Software Connection service port
Detection Strategies
- Deploy network intrusion detection signatures that inspect Programming Software Connection FileSystem API requests for malformed length and offset fields
- Baseline legitimate engineering-workstation traffic to the PLC and alert on deviations in source IP, packet size, or session frequency
- Correlate PLC fault events from historian or SCADA logs with concurrent network activity to the controller
Monitoring Recommendations
- Forward PLC diagnostic events and SCADA alarms into a centralized SIEM for correlation with network telemetry
- Capture full packet captures on OT network taps between engineering workstations and P3-550E controllers for forensic review
- Monitor for new or unauthorized hosts initiating connections to the Programming Software Connection service
How to Mitigate CVE-2024-24955
Immediate Actions Required
- Restrict network access to the P3-550E so only authorized engineering workstations can reach the Programming Software Connection service
- Place the PLC behind an OT firewall or data diode that enforces strict allowlists for source IPs and protocols
- Inventory all P3-550E devices running firmware 1.2.10.9 and prioritize them for vendor-supplied updates
- Contact AutomationDirect support to confirm availability of a fixed firmware release
Patch Information
AutomationDirect has not published a vendor advisory URL in the NVD record. Operators should consult the Talos Intelligence Vulnerability Report TALOS-2024-1938 and contact AutomationDirect directly for firmware versions later than 1.2.10.9 that remediate the FileSystem API bounds checks.
Workarounds
- Segment the PLC into a dedicated OT VLAN isolated from corporate IT networks and the internet
- Disable or block the Programming Software Connection service when programming sessions are not actively required
- Enforce VPN or jump-host access for engineers performing remote programming, and log all sessions
- Apply ICS-aware deep packet inspection at the OT perimeter to drop malformed FileSystem API requests
# Example firewall rule restricting Programming Software Connection access
# Replace <ENG_WS_IP> with the engineering workstation address and <PLC_IP> with the P3-550E
iptables -A FORWARD -s <ENG_WS_IP> -d <PLC_IP> -p tcp -j ACCEPT
iptables -A FORWARD -d <PLC_IP> -p tcp -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
