CVE-2024-24958: P3-550E Firmware Buffer Overflow Flaw

CVE-2024-24958 Overview

CVE-2024-24958 is an out-of-bounds write vulnerability in the Programming Software Connection FileSystem API of the AutomationDirect P3-550E programmable logic controller (PLC) running firmware 1.2.10.9. Specially crafted network packets trigger heap-based memory corruption through an arbitrary null-byte write at firmware offset 0xb6bdc. The flaw is reachable over the network without authentication or user interaction, allowing attackers to corrupt PLC memory and disrupt industrial control operations. The vulnerability is classified under [CWE-787] (Out-of-Bounds Write) and affects industrial automation deployments using the affected controller.

Critical Impact
Unauthenticated network attackers can corrupt heap memory on the P3-550E PLC, causing denial of service and potential integrity loss in industrial control environments.

Affected Products

AutomationDirect P3-550E hardware controller
AutomationDirect P3-550E firmware version 1.2.10.9
Industrial environments running the Programming Software Connection FileSystem API

Discovery Timeline

2024-05-28 - CVE-2024-24958 published to NVD
2026-06-17 - Last updated in NVD database
Vulnerability research and disclosure coordinated through Cisco Talos (advisory TALOS-2024-1938)

Technical Details for CVE-2024-24958

Vulnerability Analysis

The P3-550E exposes a Programming Software Connection that implements a FileSystem API over the network. This API parses incoming requests and writes data into heap-allocated buffers without enforcing proper bounds checks. Attackers send crafted packets to the controller's network interface to reach the vulnerable code path. The result is heap-based memory corruption that affects controller integrity and availability.

This CVE specifically tracks an arbitrary null-byte write primitive located at firmware offset 0xb6bdc in version 1.2.10.9. The primitive allows an attacker-controlled write of a single null byte at an attacker-influenced address within the heap region. Although a one-byte write appears limited, null-byte writes can corrupt heap metadata, truncate length fields, and pivot adjacent allocations into exploitable states.

Root Cause

The root cause is missing length validation when the FileSystem API handler processes packet fields and computes write destinations. The code does not validate that the target offset remains within the bounds of its destination buffer before writing the terminating null byte, satisfying the conditions of [CWE-787].

Attack Vector

Exploitation requires only network reachability to the PLC's programming connection service. No credentials, prior access, or user interaction are needed. An attacker on the operational technology (OT) network, or one who has pivoted from the enterprise network into the control segment, can deliver malicious packets directly to the controller. Refer to the Talos Intelligence Vulnerability Report for the packet-level technical breakdown.

No public proof-of-concept exploit code is verified for this CVE. The vulnerability is described in prose by the upstream researchers without sanitized exploitation snippets.

Detection Methods for CVE-2024-24958

Indicators of Compromise

Unexpected restarts, faults, or watchdog resets on P3-550E controllers running firmware 1.2.10.9
Unsolicited traffic to the PLC's Programming Software Connection port from non-engineering workstations
Malformed or oversized FileSystem API packets observed in OT network captures
PLC operational anomalies coinciding with inbound network sessions from untrusted hosts

Detection Strategies

Deploy OT-aware intrusion detection that parses AutomationDirect programming protocol traffic and flags malformed FileSystem API requests.
Baseline normal engineering workstation-to-PLC traffic and alert on new sources initiating programming connections.
Correlate PLC fault events with network telemetry to identify attack-driven memory corruption versus benign faults.

Monitoring Recommendations

Capture full packet data at the OT boundary and retain it for forensic review of any controller fault.
Forward PLC diagnostic logs and engineering workstation logs to a centralized analytics platform for correlation.
Monitor east-west traffic within control network zones for unauthorized programming protocol flows.

How to Mitigate CVE-2024-24958

Immediate Actions Required

Inventory all AutomationDirect P3-550E controllers and identify any running firmware 1.2.10.9.
Restrict network access to the Programming Software Connection service to authorized engineering workstations only.
Place affected PLCs behind a dedicated firewall or data diode and block inbound traffic from non-OT networks.
Disable or physically isolate programming interfaces on controllers that do not require runtime programming changes.

Patch Information

Consult AutomationDirect product support and the Talos Intelligence Vulnerability Report for the latest firmware updates that remediate the FileSystem API out-of-bounds write. Apply vendor-provided firmware revisions superseding 1.2.10.9 after validation in a non-production environment.

Workarounds

Enforce network segmentation in line with IEC 62443 zone-and-conduit guidance to limit reachability of the PLC.
Apply firewall ACLs that permit programming protocol traffic only from specific engineering workstation IP addresses.
Enable physical key-switch protection on PLCs where supported to limit programming operations during normal runtime.
Schedule maintenance windows to apply vendor firmware updates as soon as they are validated.

bash

# Example firewall rule restricting PLC programming access to a single engineering workstation
# Replace 10.10.20.5 with the authorized engineering workstation IP
# Replace 10.10.50.10 with the P3-550E controller IP
iptables -A FORWARD -s 10.10.20.5 -d 10.10.50.10 -p tcp --dport 28784 -j ACCEPT
iptables -A FORWARD -d 10.10.50.10 -p tcp --dport 28784 -j DROP