CVE-2024-23601

Executive Summary

CVE-2024-23601 is a critical code injection vulnerability in the scan_lib.bin functionality of AutomationDirect's P3-550E programmable logic controller (PLC) running firmware version 1.2.10.9. The flaw allows an attacker to achieve arbitrary code execution by supplying a specially crafted scan_lib.bin file. With a CVSS score of 9.8, this vulnerability poses a severe risk to industrial control systems (ICS) and operational technology (OT) environments. No public proof-of-concept (PoC) or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a proprietary industrial control system (ICS) device from AutomationDirect. Supply chain risks include the distribution of malicious firmware updates or scan library files through compromised vendor channels or third-party integrators.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable without authentication, allowing an attacker to fully compromise the PLC. In OT environments, this could lead to process disruption, equipment damage, or safety incidents.

Deep Dive & Mechanics

The vulnerability resides in the scan_lib.bin file parsing routine of the P3-550E PLC. The scan_lib.bin file is used to define scan patterns or library functions for the PLC's runtime. Due to insufficient input validation, an attacker can inject arbitrary code into this file. When the PLC loads the malicious scan_lib.bin, the injected code is executed with the privileges of the PLC runtime process.

The attack vector is likely through a malicious file upload or a man-in-the-middle (MITM) attack during firmware/library updates. Since the device is often deployed in air-gapped networks, physical access or compromised update channels are the primary threat vectors.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the scan_lib.bin parser. A hypothetical secure implementation would include:

• Input validation: Reject files with unexpected structures or embedded executable code.
• Sandboxing: Execute library code in a restricted environment.
• Code signing: Only accept digitally signed scan_lib.bin files.

Vulnerable code snippet (conceptual):

void load_scan_lib(char *filename) {
    FILE *f = fopen(filename, "rb");
    // No validation of file content
    execute_library(f); // Directly executes code from file
}

Patched code snippet (conceptual):

void load_scan_lib(char *filename) {
    FILE *f = fopen(filename, "rb");
    if (!verify_signature(f)) {
        log_error("Invalid signature");
        return;
    }
    if (!validate_structure(f)) {
        log_error("Invalid structure");
        return;
    }
    execute_library_in_sandbox(f);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• AutomationDirect P3-550E PLC with firmware 1.2.10.9
• Network access to the PLC's update interface (e.g., Ethernet port)
• Ability to craft a malicious scan_lib.bin file

Exploitation Steps:

1. Craft malicious scan_lib.bin: Embed shellcode or a backdoor payload into the file structure.
2. Deliver the file: Use a MITM attack on the update channel, or physically upload via USB/SD card.
3. Trigger loading: The PLC automatically loads scan_lib.bin on boot or when instructed.
4. Execute payload: The injected code runs, granting remote access or control.

Example payload structure (conceptual):

# Python script to generate malicious scan_lib.bin
import struct

payload = b"\x90" * 100  # NOP sled
payload += b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  # /bin/sh shellcode

# Embed payload into valid scan_lib.bin structure
malicious_file = b"SCANLIB" + struct.pack("<I", len(payload)) + payload
with open("malicious_scan_lib.bin", "wb") as f:
    f.write(malicious_file)

Blue Team

Detection:

• Monitor for unexpected scan_lib.bin file transfers to the PLC.
• Use network intrusion detection to flag anomalous traffic to/from the PLC.
• Implement file integrity monitoring (FIM) on the PLC's file system.

Hunting:

• Search for processes executing from non-standard memory regions.
• Analyze scan_lib.bin files for embedded executable code or unusual structure.

Containment:

• Isolate the PLC from the network if suspicious activity is detected.
• Restore from a known-good backup.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None publicly available; generate upon detection)
• Network Indicators:
  • Unusual outbound connections from the PLC to unknown IPs
  • Unexpected file transfers on port 80/443 or proprietary ports
• Host Indicators:
  • Modified scan_lib.bin file with unexpected size or structure
  • New processes or services running on the PLC
  • Unauthorized user accounts or backdoors

Detection Engineering

YARA Rule

rule CVE_2024_23601_scan_lib_malicious {
    meta:
        description = "Detects malicious scan_lib.bin files targeting AutomationDirect P3-550E"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23601"
    strings:
        $header = "SCANLIB"
        $shellcode = { 31 c0 50 68 2f 2f 73 68 68 2f 62 69 6e 89 e3 50 53 89 e1 b0 0b cd 80 }
        $nop_sled = { 90 90 90 90 90 90 90 90 }
    condition:
        $header at 0 and (any of ($shellcode, $nop_sled))
}

Sigma Rule

title: Suspicious scan_lib.bin File Transfer to AutomationDirect PLC
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network transfers of scan_lib.bin files to AutomationDirect P3-550E PLCs
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        dest_port: 80
        filename: "scan_lib.bin"
    condition: selection
falsepositives:
    - Legitimate firmware updates from trusted sources
level: high

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2024-23601 - Potential malicious scan_lib.bin transfer"; content:"scan_lib.bin"; nocase; flow:to_server; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect P3-550E PLCs from untrusted networks.
2. Monitor for suspicious activity: Use the provided detection rules.
3. Restrict physical access: Ensure only authorized personnel can interact with the PLC.

Long-term Fixes:

• Vendor patch: Await an official firmware update from AutomationDirect.
• Code signing: Implement digital signature verification for all firmware and library files.
• Network segmentation: Place PLCs in a dedicated OT VLAN with strict access controls.
• Input validation: Sanitize all uploaded files before processing.

Workarounds:

• Disable automatic loading of scan_lib.bin if possible.
• Use a network-based intrusion prevention system (IPS) to block malicious file transfers.

Valters IT
Securing Industrial Control Systems