Heap-Based Buffer Overflow Vulnerability in AutomationDirect P3-550E Firmware
CVE-2024-24946

8.2HIGH

Key Information:

Vendor

Automationdirect

Status
P3-550e
Vendor
CVE Published:
28 May 2024

What is CVE-2024-24946?

A heap-based buffer overflow vulnerability has been identified in the Programming Software Connection CurrDir functionality of AutomationDirect's P3-550E firmware version 1.2.10.9. This vulnerability manifests when an attacker sends a specially crafted network packet that exploits the memset function, allowing manipulation of an attacker-controlled length value which inadvertently corrupts trailing heap allocations. As a result, this can lead to denial of service, potentially disrupting operations and affecting system integrity. Organizations using the affected version should implement immediate mitigations to safeguard against potential exploitation.

Affected Version(s)

P3-550E 1.2.10.9

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://www.talosintelligence.com/vulnerability_reports/T...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Matt Wiseman of Cisco Talos.
.