CVE-2024-24959: P3-550E Firmware Buffer Overflow Flaw

CVE-2024-24959 Overview

CVE-2024-24959 is an out-of-bounds write vulnerability in the Programming Software Connection FileSystem API of the AutomationDirect P3-550E programmable logic controller (PLC). Specifically, the flaw allows an arbitrary null-byte write at offset 0xb6c18 in firmware version 1.2.10.9. Attackers can send specially crafted network packets to trigger heap-based memory corruption on the affected device. The vulnerability requires no authentication and is exploitable over the network, making industrial control systems exposed to untrusted networks particularly at risk.

Critical Impact
Unauthenticated attackers can corrupt heap memory on the P3-550E PLC, leading to denial of service and integrity loss in industrial control environments.

Affected Products

AutomationDirect P3-550E PLC (hardware)
AutomationDirect P3-550E firmware version 1.2.10.9
Programming Software Connection FileSystem API component

Discovery Timeline

2024-05-28 - CVE-2024-24959 published to the National Vulnerability Database (NVD)
2025-02-12 - Last updated in NVD database

Technical Details for CVE-2024-24959

Vulnerability Analysis

The vulnerability resides in the FileSystem API exposed by the Programming Software Connection service on the P3-550E. When the device parses incoming network packets, insufficient validation of length or index fields permits writing outside an allocated heap buffer. This specific CVE tracks an arbitrary null-byte write primitive located at offset 0xb6c18 in firmware 1.2.10.9. Repeated or precisely placed null-byte writes can corrupt adjacent heap metadata, function pointers, or control structures. The classification is [CWE-787] Out-of-Bounds Write.

Root Cause

The root cause is missing bounds enforcement when the FileSystem API handler processes attacker-controlled fields from network packets. The code path writes a null byte to a calculated memory address without confirming that the address falls within the bounds of the destination buffer. Because the PLC firmware does not employ modern heap hardening, a single byte write at a controlled location is enough to corrupt allocator state.

Attack Vector

An attacker with network reachability to the PLC sends crafted packets to the Programming Software Connection service. No credentials and no user interaction are required. Successful exploitation results in heap-based memory corruption that can crash the controller or alter program state. In an operational technology (OT) environment, the loss of controller availability directly impacts physical processes. See the Talos Intelligence Vulnerability Report TALOS-2024-1938 for protocol-level details.

No verified public exploit code is available. The vulnerability mechanism is described in prose only: a network packet field controls the destination address used by a write-null operation in the FileSystem API handler, and the handler does not validate the address against the allocated buffer boundary before issuing the write.

Detection Methods for CVE-2024-24959

Indicators of Compromise

Unexpected reboots, watchdog resets, or fault states on P3-550E controllers running firmware 1.2.10.9.
Inbound network traffic to the Programming Software Connection service from hosts outside the engineering workstation subnet.
Malformed or oversized FileSystem API requests captured by an OT network monitor.
Anomalous TCP sessions to the PLC that terminate abruptly after sending a payload.

Detection Strategies

Deploy an OT-aware intrusion detection system (IDS) with deep packet inspection for AutomationDirect Productivity protocol traffic.
Baseline normal engineering-workstation-to-PLC communication and alert on protocol fields with abnormal lengths or offsets.
Correlate PLC fault codes and uptime telemetry with network events targeting the controller management port.

Monitoring Recommendations

Forward PLC syslog, controller diagnostic data, and network flow records to a centralized SIEM for correlation.
Monitor for new or unauthorized hosts initiating sessions to the Programming Software Connection service.
Track firmware versions across the PLC fleet and alert when devices remain on the vulnerable 1.2.10.9 build.

How to Mitigate CVE-2024-24959

Immediate Actions Required

Restrict network access to the P3-550E so that only authorized engineering workstations can reach the Programming Software Connection service.
Place affected PLCs behind a properly segmented OT firewall following the Purdue Model for ICS network architecture.
Inventory all P3-550E devices and identify any running firmware 1.2.10.9.
Contact AutomationDirect support to confirm the latest fixed firmware release and obtain upgrade instructions.

Patch Information

At the time of NVD publication, no vendor advisory URL is listed in the CVE record. Refer to the Talos Intelligence Vulnerability Report TALOS-2024-1938 and the AutomationDirect product support portal for the current fixed firmware version. Apply the vendor-supplied firmware update during a planned maintenance window using vendor-approved upgrade procedures.

Workarounds

Block external access to the PLC programming port using access control lists on upstream switches and firewalls.
Disable or restrict the Programming Software Connection service when active engineering is not in progress, if supported by site operating procedures.
Require VPN or jump-host access for engineering workstations communicating with controllers in production zones.
Enable network anomaly detection to alert on unsolicited FileSystem API traffic targeting the controller.

bash

# Example firewall rule restricting access to the P3-550E programming service
# Replace <PLC_IP> and <ENG_WS_SUBNET> with site-specific values
iptables -A FORWARD -p tcp -s <ENG_WS_SUBNET> -d <PLC_IP> -j ACCEPT
iptables -A FORWARD -d <PLC_IP> -j DROP