CVE-2024-24963: P3-550E Firmware Buffer Overflow Flaw

CVE-2024-24963 Overview

A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E firmware version 1.2.10.9. This vulnerability allows an attacker to send a specially crafted network packet to trigger a stack-based buffer overflow, potentially leading to arbitrary code execution on the affected device. The vulnerability is particularly severe because it can be exploited without authentication, meaning any attacker with network access to the vulnerable device can attempt exploitation.

This vulnerability is tracked at memory offset 0xb6e84 within version 1.2.10.9 of the P3-550E firmware and affects multiple AutomationDirect Productivity Series programmable logic controllers (PLCs) used in industrial control systems (ICS) and operational technology (OT) environments.

Critical Impact

Unauthenticated remote attackers can exploit this stack-based buffer overflow to potentially gain complete control over affected industrial controllers, disrupting critical manufacturing and automation processes.

Affected Products

• AutomationDirect P3-550E Firmware (versions 1.2.10.9 and 4.1.1.10)
• AutomationDirect P3-550 Firmware (versions 1.2.10.9 and 4.1.1.10)
• AutomationDirect P3-530 Firmware (versions 1.2.10.9 and 4.1.1.10)
• AutomationDirect P2-550 Firmware (versions 1.2.10.10 and 4.1.1.10)
• AutomationDirect P1-550 Firmware (versions 1.2.10.10 and 4.1.1.10)
• AutomationDirect P1-540 Firmware (versions 1.2.10.10 and 4.1.1.10)

Discovery Timeline

• 2024-05-28 - CVE-2024-24963 published to NVD
• 2025-02-12 - Last updated in NVD database

Technical Details for CVE-2024-24963

Vulnerability Analysis

This vulnerability affects the FileSelect functionality within the Programming Software Connection component of AutomationDirect Productivity Series PLCs. The FileSelect feature is part of the communication protocol used between the PLC and programming software, typically used for file operations during device configuration and maintenance.

The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). When processing network packets related to file selection operations, the firmware fails to properly validate the length of input data before copying it to a fixed-size stack buffer. This allows an attacker to overflow the buffer and potentially overwrite adjacent stack memory, including the return address.

Because the vulnerability requires no authentication, any attacker with network connectivity to the PLC's programming interface can craft malicious packets to trigger the overflow. In industrial environments where these PLCs may be connected to operational networks, this represents a significant threat to process control and safety systems.

Root Cause

The root cause of this vulnerability is insufficient input validation in the FileSelect packet handler within the Programming Software Connection functionality. The firmware allocates a fixed-size buffer on the stack to store incoming file path or filename data but does not properly validate that the incoming data length does not exceed the buffer capacity. When oversized data is provided in a crafted network packet, it overwrites adjacent stack memory at offset 0xb6e84.

Attack Vector

The attack vector is network-based, requiring the attacker to send specially crafted packets to the PLC's programming software connection port. The exploitation requires no authentication or prior access to the device, making it accessible to any attacker who can reach the device over the network. The attack can potentially be executed remotely across network boundaries if the PLC is exposed to untrusted networks.

The attacker sends a malformed network packet to the FileSelect handler containing data that exceeds the expected buffer size. This triggers a stack-based buffer overflow that can overwrite the return address and potentially redirect execution flow to attacker-controlled code. For more technical details, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2024-24963

Indicators of Compromise

• Unexpected network traffic to programming software connection ports on AutomationDirect PLCs
• Abnormally large packets directed at the FileSelect functionality
• PLC device crashes, unexpected reboots, or unresponsive behavior
• Changes to PLC configuration or programming that were not authorized

Detection Strategies

• Implement network intrusion detection rules to identify oversized packets targeting AutomationDirect PLC programming interfaces
• Monitor for unusual patterns in the programming software connection protocol traffic
• Deploy deep packet inspection capable of identifying malformed FileSelect requests
• Use industrial protocol-aware security tools to baseline normal PLC communication patterns

Monitoring Recommendations

• Enable logging on network infrastructure to capture traffic to/from PLC devices
• Implement anomaly detection for deviations from established communication baselines with PLCs
• Configure alerts for any network connections to PLCs from unexpected source addresses
• Monitor PLC health indicators for signs of exploitation such as unexpected restarts or communication failures

How to Mitigate CVE-2024-24963

Immediate Actions Required

• Isolate affected AutomationDirect PLCs from untrusted network segments immediately
• Implement network segmentation to restrict access to PLC programming interfaces to authorized engineering workstations only
• Review and audit network access controls to ensure only necessary personnel can reach PLC devices
• Contact AutomationDirect for the latest firmware updates addressing this vulnerability

Patch Information

Organizations should contact AutomationDirect directly for firmware updates that address this vulnerability. The affected firmware versions include 1.2.10.9 and 1.2.10.10 across the Productivity Series product line. Review the Talos Intelligence Vulnerability Report for additional technical guidance and update recommendations.

Workarounds

• Implement strict network segmentation placing PLCs in isolated OT network zones with firewall controls
• Restrict access to programming software connection ports using access control lists (ACLs) on network devices
• Use VPN or jump servers to require authenticated access before reaching PLC networks
• Disable the programming software connection if remote programming capabilities are not required during normal operations
• Deploy industrial firewalls or protocol-aware security gateways in front of PLC networks

# Example network segmentation firewall rule
# Block direct access to PLC programming ports from untrusted networks
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 2222 -j DROP
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 44818 -j DROP
# Allow access only from authorized engineering workstation
iptables -A FORWARD -s 10.10.50.100/32 -o eth1 -p tcp --dport 2222 -j ACCEPT