CVE-2024-24954

Executive Summary

CVE-2024-24954 is a critical heap-based memory corruption vulnerability affecting the AutomationDirect P3-550E programmable logic controller (PLC) running firmware version 1.2.10.9. The flaw resides in the Programming Software Connection FileSystem API, specifically at offset 0xb69c8, where an arbitrary null-byte write can be triggered by sending specially crafted network packets. This out-of-bounds write leads to heap corruption, potentially causing denial of service (DoS) or arbitrary code execution in the context of the PLC firmware. With a CVSS score of 8.2 (High), the vulnerability is remotely exploitable without authentication, making it a significant threat to industrial control systems (ICS) environments. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the critical nature of PLCs in critical infrastructure, immediate mitigation measures are recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Total loss of availability (DoS or crash).
• Threat Level: High – Remote, unauthenticated exploitation with low complexity.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in the FileSystem API of the AutomationDirect P3-550E PLC firmware. The flaw specifically allows an arbitrary null-byte write at offset 0xb69c8 in the firmware binary. This occurs when the PLC processes specially crafted network packets sent to the Programming Software Connection service.

Technical Details:

• Root Cause: The FileSystem API fails to validate the length or bounds of input data before writing to a heap buffer. An attacker can send a packet that causes the firmware to write a null byte (0x00) to an arbitrary memory location relative to the heap.
• Impact: A single null-byte write can corrupt heap metadata (e.g., chunk headers, free lists), leading to heap-based memory corruption. This can cause the PLC to crash (DoS) or, in advanced scenarios, be leveraged for code execution by corrupting function pointers or return addresses.
• Attack Vector: The vulnerability is triggered via network packets sent to the PLC’s programming port (typically port 502 for Modbus or a proprietary port). No authentication is required.
• Firmware Offset: The vulnerable code is located at offset 0xb69c8 in firmware version 1.2.10.9. This offset corresponds to a specific instruction or function that performs the unchecked write.

Potential Exploitation Scenarios:

1. Denial of Service: Repeatedly sending malicious packets crashes the PLC, halting industrial processes.
2. Arbitrary Code Execution: By carefully corrupting heap structures, an attacker could overwrite a function pointer and redirect execution to shellcode, gaining full control of the PLC.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in firmware 1.2.10.9 at offset 0xb69c8. A hypothetical patch would involve adding bounds checking before the write operation.

Vulnerable Code (Assembly-like):

; At offset 0xb69c8
; Assume r0 points to input buffer, r1 points to heap destination
; No bounds check on r1
strb r2, [r1, #0]  ; Write null byte to heap address

Patched Code (Hypothetical):

; At offset 0xb69c8
; Add bounds check
cmp r1, heap_end
bhs error_handler
strb r2, [r1, #0]  ; Write null byte only if within bounds

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Hardware: AutomationDirect P3-550E PLC with firmware 1.2.10.9.
• Network: Isolated lab network with the PLC on a dedicated VLAN.
• Tools: Python with Scapy, Metasploit (if module available), custom exploit script.

Exploitation Steps:

1. Reconnaissance: Scan for PLCs using Shodan dorks or Nmap (nmap -p 502 --script modbus-discover <target>).
2. Craft Malicious Packet: The vulnerability is triggered by sending a specially crafted packet to the FileSystem API. Since no public PoC exists, reverse engineering the firmware at offset 0xb69c8 is required to determine the exact packet structure.
3. Trigger Null-Byte Write: Send the packet to the PLC’s programming port. The null-byte write corrupts heap metadata.
4. Achieve DoS: The PLC crashes, requiring a power cycle to recover.
5. Attempt Code Execution: For advanced exploitation, heap feng shui techniques can be used to overwrite a function pointer with a controlled address.

Example Python Script (Conceptual):

import socket

def exploit(target_ip, target_port=502):
    # Craft packet based on reverse engineering
    # This is a placeholder; actual packet structure unknown
    packet = b"\x00" * 100  # Malformed data
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(packet)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Blue Team (Defensive)

Detection & Prevention:

• Network Monitoring: Monitor for anomalous traffic to port 502 (Modbus) or other programming ports. Use Suricata rules (see Detection Engineering).
• Host-Based Controls: If possible, restrict network access to the PLC using firewall rules. Only allow trusted IPs.
• Firmware Hardening: Disable unused services and APIs on the PLC.
• Patching: Apply vendor patches when available. Since none exist, consider isolating the PLC from the corporate network.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Malformed Modbus/TCP packets with unexpected lengths or payloads.
  • Traffic to port 502 from untrusted IPs.
• Host IOCs:
  • PLC crash logs indicating heap corruption.
  • Unexpected reboots or watchdog timeouts.
• File IOCs:
  • Firmware hash: SHA256 of vulnerable firmware 1.2.10.9 (if available).

Detection Engineering

YARA Rule

rule CVE_2024_24954_Arbitrary_Null_Write {
    meta:
        description = "Detects firmware binary with vulnerable null-byte write at offset 0xb69c8"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-24954"
    strings:
        $vuln_offset = { ?? ?? ?? ?? b6 9c 8? }  // Pattern at offset 0xb69c8
    condition:
        $vuln_offset
}

Sigma Rule

title: CVE-2024-24954 Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic targeting AutomationDirect P3-550E PLC with malformed packets
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 502
        payload_length: "> 100"  # Adjust based on reverse engineering
    condition: selection
falsepositives:
    - Legitimate large Modbus packets
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-24954 - Potential Null-Byte Write Exploit"; flow:to_server; content:"|00|"; depth:100; pcre:"/^.{0,100}\x00/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate the PLC from untrusted networks using VLANs or firewalls.
   • Restrict access to the programming port (port 502) to only authorized IPs.
   • Monitor network traffic for anomalies using the provided Suricata/Sigma rules.

2. Long-Term Fix:

   • Apply vendor patch when released. Contact AutomationDirect for updates.
   • Upgrade to a patched firmware version if available.

3. Compensating Controls:

   • Use an IDS/IPS to block malformed packets.
   • Implement network segmentation for all ICS devices.
   • Regularly backup PLC configurations and firmware.

4. Detection:

   • Deploy YARA rules to scan firmware binaries.
   • Enable logging on network gateways to capture Modbus traffic.

Valters IT