CVE-2024-36980

Executive Summary

CVE-2024-36980 is a high-severity (CVSS 7.5) out-of-bounds read vulnerability in the OpenPLC Runtime EtherNet/IP PCCC parser. The flaw resides in the OpenPLC_v3 build b4702061dc14d1024856f71b4543298d77007b88. An unauthenticated attacker can send a specially crafted EtherNet/IP request to trigger an out-of-bounds read, leading to a denial of service (DoS) condition. The vulnerability is classified as an incorrect comparison in the parser logic, which allows memory access beyond allocated boundaries. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for industrial control system (ICS) environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects the OpenPLC runtime, which is a C/C++ based industrial control system. Supply chain risks are limited to the OpenPLC project itself, and no package manager dependencies are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for attackers targeting ICS/SCADA environments. However, the lack of public exploit code and low EPSS score reduce immediate risk.

Deep Dive & Mechanics

The vulnerability exists in the PCCC (Programmable Controller Communications Commands) parser of the OpenPLC Runtime EtherNet/IP stack. The parser incorrectly handles boundary checks when processing incoming EtherNet/IP packets. Specifically, the first instance of an incorrect comparison allows an attacker to craft a packet that causes the parser to read memory beyond the allocated buffer.

Root Cause: The parser uses a comparison that does not properly validate the length of the incoming data against the buffer size. This leads to an out-of-bounds read when the parser attempts to access data at an offset that exceeds the buffer's capacity.

Attack Vector: An attacker sends a series of EtherNet/IP requests to the OpenPLC runtime on port 44818 (default EtherNet/IP port). The crafted packet contains a PCCC command with a manipulated length field that triggers the out-of-bounds read.

Impact: The out-of-bounds read causes the OpenPLC runtime to crash or become unresponsive, resulting in a denial of service. This can disrupt industrial control processes, leading to production downtime or safety hazards.

Vulnerable vs. Patched Code

Vulnerable Code (OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88): The vulnerable code is in the PCCC parser function. The incorrect comparison is likely in a loop or conditional that checks the remaining buffer size. For example:

// Vulnerable: incorrect comparison
if (offset + length > buffer_size) {
    // handle error
}
// The comparison should be >= to prevent out-of-bounds read

Patched Code (Hypothetical): A proper fix would use a strict greater-than-or-equal comparison:

// Patched: correct comparison
if (offset + length >= buffer_size) {
    // handle error
}

No official patch is available from the vendor.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• OpenPLC_v3 build b4702061dc14d1024856f71b4543298d77007b88 running on a target system.
• Network access to port 44818 (EtherNet/IP).

Exploitation Steps:

1. Identify the target OpenPLC instance using Shodan or network scanning.
2. Craft a malicious EtherNet/IP packet with a PCCC command that includes an oversized length field.
3. Send the packet to the target using a tool like Scapy or a custom Python script.
4. Repeat the request to trigger the out-of-bounds read and cause a denial of service.

Example Python script (conceptual):

import socket

def exploit(target_ip, target_port=44818):
    # Craft malicious EtherNet/IP packet (simplified)
    packet = b'\x00' * 100  # Placeholder for actual crafted packet
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(packet)
    sock.close()

exploit("192.168.1.100")

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense)

Detection:

• Monitor for unusual EtherNet/IP traffic on port 44818.
• Use network intrusion detection systems (NIDS) to detect malformed PCCC commands.
• Implement rate limiting for EtherNet/IP connections.

Mitigation:

• Isolate OpenPLC devices on a separate network segment.
• Use firewalls to restrict access to port 44818 from untrusted networks.
• Apply virtual patching via WAF or IPS rules.
• Monitor for crashes or unresponsive OpenPLC instances.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Malformed EtherNet/IP packets with PCCC commands containing oversized length fields.
  • Repeated connections to port 44818 from a single source IP.
  • Unusual EtherNet/IP session patterns (e.g., rapid connection/disconnection).

• Host IOCs:

  • OpenPLC runtime crashes or logs indicating out-of-bounds read errors.
  • High CPU or memory usage in the OpenPLC process.
  • System logs showing segmentation faults or access violations.

• File IOCs:

  • No specific file-based IOCs identified.

Detection Engineering

YARA Rule

rule CVE_2024_36980_OpenPLC_OOB_Read {
    meta:
        description = "Detects malicious EtherNet/IP packets targeting CVE-2024-36980"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36980"
    strings:
        $pccc_header = { 00 00 00 00 00 00 00 00 }  // Placeholder for PCCC header pattern
        $oob_trigger = { FF FF FF FF }  // Placeholder for oversized length field
    condition:
        $pccc_header at 0 and $oob_trigger
}

Sigma Rule

title: CVE-2024-36980 OpenPLC EtherNet/IP OOB Read
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects malformed EtherNet/IP packets targeting OpenPLC
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 44818
        payload|contains: "FF FF FF FF"  # Placeholder for malicious payload
    condition: selection
falsepositives:
    - Legitimate EtherNet/IP traffic with similar patterns (rare)
level: high

Suricata Rule

alert tcp any any -> any 44818 (msg:"CVE-2024-36980 OpenPLC EtherNet/IP OOB Read Attempt"; flow:to_server; content:"|FF FF FF FF|"; offset:0; depth:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate OpenPLC devices on a dedicated network segment with strict firewall rules.
2. Access Control: Restrict access to port 44818 to only trusted IP addresses.
3. Monitoring: Enable logging and monitoring for EtherNet/IP traffic and OpenPLC crashes.

Long-term Fix:

• Apply a vendor patch when available. Since no patch exists, consider upgrading to a newer version of OpenPLC if a fix is released.
• Implement a virtual patch using an IPS/IDS to block malformed EtherNet/IP packets.
• Consider using a different PLC runtime if the vulnerability cannot be mitigated.

Workarounds:

• Disable EtherNet/IP support if not required.
• Use a reverse proxy or application-layer firewall to inspect and sanitize EtherNet/IP traffic.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert