Out-of-bounds Write Vulnerabilities in AutomationDirect P3-550E Firmware

CVE-2024-24957

What is CVE-2024-24957?

The AutomationDirect P3-550E product contains several out-of-bounds write vulnerabilities in its Programming Software Connection FileSystem API. These vulnerabilities enable attackers to exploit specially crafted network packets, resulting in potential heap-based memory corruption. Specifically, the arbitrary null-byte write vulnerability is present in firmware version 1.2.10.9, located at offset 0xb6aa4. Attackers can manipulate network traffic to trigger these out-of-bounds writes, leading to severe security implications.

References