CVE-2024-24957 Overview
CVE-2024-24957 is an out-of-bounds write vulnerability in the Programming Software Connection FileSystem API of the AutomationDirect P3-550E programmable logic controller (PLC). The flaw affects firmware version 1.2.10.9 and is tracked as a heap-based memory corruption issue [CWE-787]. An unauthenticated attacker can send specially crafted network packets to trigger an arbitrary null-byte write at offset 0xb6aa4, corrupting heap memory on the device. Because the P3-550E is an industrial control system component, successful exploitation can disrupt automation processes and compromise device availability.
Critical Impact
Remote, unauthenticated attackers can corrupt heap memory on the P3-550E PLC, leading to denial of service and potential integrity loss in industrial control environments.
Affected Products
- AutomationDirect P3-550E hardware (Productivity3000 CPU)
- AutomationDirect P3-550E firmware version 1.2.10.9
- Systems using the Programming Software Connection FileSystem API on affected firmware
Discovery Timeline
- 2024-05-28 - CVE-2024-24957 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24957
Vulnerability Analysis
The vulnerability resides in the FileSystem API exposed through the Programming Software Connection protocol on the P3-550E. When the device parses incoming network packets, it fails to validate boundary conditions before writing to heap-allocated memory. This specific CVE tracks an arbitrary null-byte write at firmware offset 0xb6aa4. An attacker controls the destination address of a single null byte (0x00), allowing targeted corruption of heap metadata, function pointers, or adjacent control structures. The attack does not require authentication or user interaction and is reachable over the network. Repeated or precisely placed writes can drive the PLC into an unrecoverable state, impacting industrial processes that depend on the controller.
Root Cause
The root cause is missing bounds validation in the FileSystem API packet handler within firmware 1.2.10.9. The handler accepts attacker-supplied length or offset values and writes a null terminator into a heap region without verifying that the target address falls within the allocated buffer. This classic out-of-bounds write pattern [CWE-787] permits heap-based memory corruption.
Attack Vector
Exploitation requires network access to the PLC's Programming Software Connection service. An attacker sends a malicious FileSystem API request containing crafted parameters that cause the firmware to write a null byte outside the intended buffer. The vulnerability affects integrity at a limited level and availability at a high level, consistent with corruption that crashes the controller or alters small portions of in-memory state. No authentication, privileges, or user interaction are required. See the Talos Intelligence Vulnerability Report TALOS-2024-1938 for the full technical analysis.
Detection Methods for CVE-2024-24957
Indicators of Compromise
- Unexpected restarts, watchdog resets, or fault conditions reported by P3-550E controllers running firmware 1.2.10.9.
- Anomalous traffic targeting the Programming Software Connection service from hosts outside the engineering workstation subnet.
- Malformed or oversized FileSystem API requests captured in network traces between operator stations and the PLC.
Detection Strategies
- Deploy industrial protocol-aware intrusion detection sensors that decode AutomationDirect Productivity3000 traffic and flag malformed FileSystem API frames.
- Baseline normal programming traffic patterns and alert on FileSystem API calls originating from unapproved sources or occurring outside maintenance windows.
- Correlate PLC fault logs, controller reboots, and HMI communication losses with corresponding network packet captures to identify exploitation attempts.
Monitoring Recommendations
- Continuously capture and retain north-south and east-west traffic on the operational technology (OT) network segment hosting the PLC for forensic review.
- Monitor controller diagnostic registers and event logs for memory faults, communication errors, and unexpected mode transitions.
- Track changes to the engineering workstation inventory to ensure only authorized hosts initiate Programming Software Connection sessions.
How to Mitigate CVE-2024-24957
Immediate Actions Required
- Inventory all AutomationDirect P3-550E controllers and identify any running firmware 1.2.10.9 or earlier.
- Restrict network access to the Programming Software Connection service so that only authorized engineering workstations can reach the PLC.
- Place affected PLCs behind a properly configured industrial firewall and disable any remote or internet-facing exposure of the device.
- Contact AutomationDirect for vendor guidance and apply updated firmware as soon as it becomes available.
Patch Information
No vendor advisory URL is listed in the NVD record at the time of writing. Refer to the Talos Intelligence Vulnerability Report TALOS-2024-1938 for coordinated disclosure details and check the AutomationDirect support portal for firmware updates that supersede 1.2.10.9.
Workarounds
- Segment OT networks using zones and conduits per IEC 62443, ensuring the PLC resides in a controlled cell behind firewalls.
- Enforce allowlists on industrial firewalls so that only specific engineering workstation IP addresses can communicate with the PLC's programming service.
- Disable the Programming Software Connection service when active engineering work is not in progress, where operationally feasible.
- Require VPN, jump-host, or unidirectional gateway access for any remote programming sessions to the controller.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
