CVE-2024-24958

Executive Summary

CVE-2024-24958 is a critical out-of-bounds write vulnerability affecting the AutomationDirect P3-550E programmable logic controller (PLC) running firmware version 1.2.10.9. The flaw resides in the Programming Software Connection FileSystem API, specifically at offset 0xb6bdc, where an arbitrary null-byte write can be triggered by specially crafted network packets. This leads to heap-based memory corruption, potentially causing denial of service (DoS) or arbitrary code execution. With a CVSS score of 8.2, the vulnerability is remotely exploitable without authentication, posing a significant risk to industrial control systems (ICS) environments. No public proof-of-concept (PoC) or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: High (A:H) – Likely causes system crash or denial of service.

Threat Level: Critical for ICS/SCADA environments. The null-byte write can corrupt heap metadata, leading to unpredictable behavior, including remote code execution in some scenarios.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in the FileSystem API of the AutomationDirect P3-550E PLC. The firmware version 1.2.10.9 contains a flaw at memory offset 0xb6bdc where a null byte (0x00) is written to an arbitrary memory location. This occurs when processing specially crafted network packets sent to the Programming Software Connection interface.

Technical Details:

• Root Cause: Improper validation of input data length or pointer arithmetic in the FileSystem API handler. An attacker can manipulate packet fields to cause the software to write a null byte beyond the intended buffer boundary.
• Impact: Heap-based memory corruption. A single null byte write can corrupt heap chunk headers, leading to crashes (DoS) or, in advanced exploitation, arbitrary code execution via heap spraying or other techniques.
• Attack Vector: Remote, unauthenticated network packets. The PLC listens on TCP ports typically used for programming software (e.g., port 502 for Modbus, but the specific port is vendor-defined). The attacker sends malicious packets to trigger the null-byte write.

Affected Component: AutomationDirect P3-550E firmware 1.2.10.9. No other versions are confirmed vulnerable, but similar models may be affected.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the firmware binary at offset 0xb6bdc. A hypothetical patch would involve:

• Adding bounds checking before memory writes.
• Validating packet lengths and offsets.
• Using safe memory functions (e.g., memcpy_s instead of memcpy).

Vulnerable Code (Hypothetical Assembly):

; At offset 0xb6bdc
mov eax, [packet_offset]   ; User-controlled offset
mov byte [heap_buffer + eax], 0x00  ; Null-byte write without bounds check

Patched Code (Hypothetical):

; Bounds check added
mov eax, [packet_offset]
cmp eax, [buffer_size]
jae error_handler
mov byte [heap_buffer + eax], 0x00

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• AutomationDirect P3-550E PLC with firmware 1.2.10.9.
• Network access to the PLC (e.g., local network or exposed interface).
• Knowledge of the programming protocol (likely proprietary, but reverse-engineered).

Exploitation Steps:

1. Reconnaissance: Scan for PLCs using Shodan dorks (e.g., "P3-550E").
2. Craft Malicious Packet: Construct a network packet that triggers the null-byte write at offset 0xb6bdc. The packet must include a field that controls the write offset.
3. Send Packet: Use a tool like Scapy or a custom Python script to send the packet to the PLC.
4. Observe Impact: The PLC may crash (DoS) or become unstable. For code execution, combine with heap spraying.

Example Python Script (Conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 502  # Example port

# Craft packet (simplified)
packet = b"\x00" * 100  # Placeholder
# Modify offset field to trigger null-byte write
packet = packet[:0xb6bdc] + b"\x00" + packet[0xb6bdc+1:]

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(packet)
sock.close()

Note: No public exploit code is available. This is a conceptual example.

Blue Team (Defense)

Detection:

• Monitor for anomalous network traffic to PLC ports (e.g., port 502).
• Use IDS/IPS rules to detect malformed packets (see Suricata rules below).
• Enable logging on PLCs and network devices.

Mitigation:

• Isolate PLCs on segmented networks (e.g., using VLANs or firewalls).
• Restrict access to programming interfaces via IP whitelisting.
• Apply vendor patches when available.
• Use network-based intrusion prevention systems (NIPS) to block exploit attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual packets targeting PLC programming ports (e.g., port 502, 44818).
  • Packets with malformed lengths or offsets.
  • Repeated connection attempts from unknown IPs.
• Host IOCs:
  • PLC crash logs or unexpected reboots.
  • Memory corruption errors in system logs.
  • Unexpected null-byte writes in heap memory.
• File IOCs:
  • Firmware binary with hash: sha256: [unknown] (no public hash available).

Detection Engineering

YARA Rule

rule CVE_2024_24958_Exploit_Packet {
    meta:
        description = "Detects network packets targeting CVE-2024-24958 null-byte write"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24958"
    strings:
        $null_byte = { 00 }
        $offset_marker = { b6 bd c0 }  // Hypothetical offset in packet
    condition:
        $offset_marker and #null_byte > 10
}

Sigma Rule

title: CVE-2024-24958 Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic targeting AutomationDirect P3-550E null-byte write vulnerability
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port:
            - 502
            - 44818
        payload|contains: "b6bdc"  # Hypothetical offset in hex
    condition: selection
falsepositives:
    - Legitimate programming traffic
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-24958 Exploit Attempt"; content:"|b6 bd c0|"; offset:0; depth:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate PLCs: Place P3-550E devices on isolated network segments with strict firewall rules.
2. Disable Unused Services: Turn off programming interfaces if not needed.
3. Monitor Traffic: Deploy IDS/IPS with custom rules to detect exploit attempts.
4. Apply Patches: Contact AutomationDirect for firmware updates. No patch is currently available.

Long-Term Measures:

• Implement network segmentation for all ICS devices.
• Use VPNs for remote access to PLCs.
• Regularly update firmware and software.
• Conduct security assessments of ICS environments.

Workaround: If patching is not possible, restrict network access to the PLC to trusted IPs only and monitor for anomalous traffic.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert