CVE-2024-22187

Executive Summary

CVE-2024-22187 is a critical write-what-where vulnerability in the AutomationDirect P3-550E programmable logic controller (PLC) firmware version 1.2.10.9. The flaw resides in the Programming Software Connection Remote Memory Diagnostics functionality, allowing an unauthenticated attacker to send a specially crafted network packet to perform an arbitrary write to any memory location. With a CVSS score of 9.1, this vulnerability can lead to complete compromise of the device, including arbitrary code execution, denial of service, or persistent firmware modification. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the severity demands immediate attention for asset owners.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary industrial control system (ICS) device from AutomationDirect. The risk is confined to the hardware/firmware supply chain of the P3-550E PLC.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full read access to device memory is possible.
• Integrity (I): High – Arbitrary writes can modify firmware, configuration, or runtime data.
• Availability (A): High – An attacker can crash the device or corrupt critical memory.

Threat Level: Critical. The combination of network accessibility, no authentication, and full write capability makes this a top-priority vulnerability for any organization using the P3-550E.

Deep Dive & Mechanics

The vulnerability is a classic write-what-where condition (CWE-123) in the Remote Memory Diagnostics feature of the AutomationDirect P3-550E PLC. This feature is intended for legitimate diagnostic purposes, allowing a programming software to read and write memory locations remotely. However, the implementation fails to validate the target memory address or the data being written, and it does not require authentication.

Technical Breakdown:

1. Trigger: The PLC listens on a specific TCP/UDP port (likely port 80 or a proprietary port) for diagnostic commands.
2. Packet Structure: A specially crafted network packet contains a memory address and data payload. The firmware processes this packet without proper bounds checking or authorization.
3. Arbitrary Write: The attacker can specify any memory address (e.g., firmware code, configuration registers, or I/O buffers) and write arbitrary data. This can be used to:
   • Overwrite firmware to gain persistent control.
   • Modify runtime variables to alter PLC behavior.
   • Corrupt critical system structures to cause a denial of service.
4. No Authentication: The diagnostic interface does not require any credentials, making the attack trivially exploitable from any network-accessible location.

Attack Scenario: An attacker on the same network as the PLC (or via the internet if exposed) sends a malicious packet to the device. The packet includes a target address (e.g., 0x00000000 for firmware base) and data (e.g., shellcode or a crash value). The PLC writes the data to that address, leading to immediate code execution or system crash.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, based on the vulnerability description, the following pseudo-code illustrates the vulnerable logic:

Vulnerable Code (Pseudo-C):

void handle_diagnostics_packet(packet_t *pkt) {
    uint32_t address = pkt->address;
    uint32_t data = pkt->data;
    // No bounds check, no authentication
    *(uint32_t *)address = data;  // Write-what-where
}

Patched Code (Hypothetical):

void handle_diagnostics_packet(packet_t *pkt) {
    if (!is_authenticated(pkt->source)) {
        return;  // Reject unauthenticated requests
    }
    uint32_t address = pkt->address;
    uint32_t data = pkt->data;
    if (!is_valid_memory_range(address)) {
        return;  // Reject out-of-bounds writes
    }
    *(uint32_t *)address = data;
}

The patch would require:

• Authentication (e.g., password or certificate) for diagnostic commands.
• Memory address validation to restrict writes to safe regions.
• Input sanitization and rate limiting.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Hardware: AutomationDirect P3-550E PLC (firmware 1.2.10.9)
• Network: Isolated VLAN with attacker machine (Kali Linux)
• Tools: Python, Scapy, custom packet crafting

Exploitation Steps:

1. Identify Target: Use Nmap to scan for the PLC (e.g., port 80 or 502).

   nmap -p 80,502 --open <target_ip>
   

2. Craft Malicious Packet: Use Scapy to send a write-what-where payload.

   from scapy.all import *
   import struct
   
   target_ip = "192.168.1.100"
   target_port = 80  # Example port
   
   # Craft packet: address=0x08000000 (firmware), data=0xDEADBEEF
   payload = struct.pack("!II", 0x08000000, 0xDEADBEEF)
   packet = IP(dst=target_ip)/TCP(dport=target_port)/Raw(load=payload)
   send(packet)
   

3. Verify Exploit: Monitor PLC behavior (e.g., crash, LED status, or network traffic). For code execution, replace data with shellcode.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection & Response:

• Network Monitoring: Look for anomalous packets to port 80/502 with unusual payloads (e.g., large binary data or specific memory addresses).
• Honeypot: Deploy a decoy P3-550E to capture attack patterns.
• Logging: Enable PLC syslog or SNMP traps to detect diagnostic command usage.
• Mitigation: Isolate PLCs on a separate VLAN with strict firewall rules. Disable Remote Memory Diagnostics if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TCP/UDP packets to port 80 or 502 with payloads containing memory addresses (e.g., 0x08000000, 0x00000000).
  • Unusual outbound connections from the PLC to unknown IPs.
• Host IOCs:
  • Unexpected firmware changes (check CRC/hash).
  • PLC crash logs or watchdog resets.
  • Modified configuration registers.
• File IOCs:
  • None (no file system involved).

Detection Engineering

YARA Rule

rule CVE_2024_22187_WriteWhatWhere {
    meta:
        description = "Detects network packets targeting AutomationDirect P3-550E write-what-where vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22187"
    strings:
        $magic = { 08 00 00 00 }  // Example memory address (0x08000000)
        $pattern = { ?? ?? ?? ?? ?? ?? ?? ?? }  // Generic address+data pattern
    condition:
        $magic at 0 and filesize == 8
}

Sigma Rule

title: CVE-2024-22187 Write-What-Where Exploit Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network packets targeting AutomationDirect P3-550E Remote Memory Diagnostics
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port:
            - 80
            - 502
        payload_length: 8
        payload|contains: "08000000"  # Example address
    condition: selection
falsepositives:
    - Legitimate diagnostic traffic (rare)
level: critical

Suricata Rule

alert tcp any any -> any 80,502 (msg:"CVE-2024-22187 Write-What-Where Exploit Attempt"; content:"|08 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate PLCs: Place all P3-550E devices on a dedicated, firewalled VLAN with no direct internet access.
2. Disable Remote Memory Diagnostics: If the feature is not required, disable it via the PLC configuration interface.
3. Network Segmentation: Use strict ACLs to allow only trusted IPs (e.g., engineering workstations) to communicate with the PLC.
4. Monitor Traffic: Deploy the above Suricata/Sigma rules to detect exploitation attempts.

Long-Term Actions:

1. Vendor Patch: Contact AutomationDirect for a firmware update. Monitor their security advisory page.
2. Replace Hardware: If no patch is forthcoming, consider replacing the P3-550E with a more secure alternative.
3. Harden Configuration: Change default passwords, disable unused services, and enable logging.

Workaround: If Remote Memory Diagnostics must remain enabled, implement a network-level proxy that validates all diagnostic packets before forwarding to the PLC.

Valters IT
Securing Industrial Control Systems
Contact: info@valters-it.com