« Back to list

CVE-2024-24947

Status: AnalyzedHigh (8.2)—

A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb68c4` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (6)

Automationdirect — P1-540 FirmwareAutomationdirect — P1-550 FirmwareAutomationdirect — P2-550 FirmwareAutomationdirect — P3-530 FirmwareAutomationdirect — P3-550 FirmwareAutomationdirect — P3-550e Firmware

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-24947",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-24947",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-28T17:40:06.911050Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "AutomationDirect",
          "product": "P3-550E",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.10.9"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:automationdirect:p3-550e:1.2.10.9:*:*:*:*:*:*:*"
          ],
          "vendor": "automationdirect",
          "product": "p3-550e",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.10.9"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-28T16:15:13.650",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1937",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1937",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb68c4` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de desbordamiento de búfer de almacenamiento dinámico en la funcionalidad CurrDir de conexión del software de programación de AutomationDirect P3-550E 1.2.10.9. Un paquete de red especialmente manipulado puede provocar una denegación de servicio. Un atacante puede enviar un paquete no autenticado para desencadenar esta vulnerabilidad. Este CVE rastrea la corrupción del montón que ocurre en el desplazamiento `0xb68c4` de la versión 1.2.10.9 del firmware P3-550E, que ocurre cuando una llamada a `memset` depende de un atacante -Valor de longitud controlado y corrompe cualquier asignación de montón final."
    }
  ],
  "lastModified": "2026-06-17T07:15:16.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A393F14-3BD3-44DE-B06F-9235AB62C68F"
            },
            {
              "criteria": "cpe:2.3:o:automationdirect:p3-550e_firmware:4.1.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A4772E7-8788-4DB5-98CE-25F0255E0386"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:p3-550e:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5086EF1F-C3CE-4B5F-A352-67CE332A6C4F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:p3-550_firmware:1.2.10.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC227F17-D280-4C74-A73E-8F92158686BE"
            },
            {
              "criteria": "cpe:2.3:o:automationdirect:p3-550_firmware:4.1.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CC4A2E2-DF6D-427A-88E6-54FD6D11BDFC"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:p3-550:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BB4DDF3B-AB0E-4DDD-9865-D4EEDCCA78DE"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:p3-530_firmware:1.2.10.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0462A9CE-4EAA-4C12-9147-F530C42328D3"
            },
            {
              "criteria": "cpe:2.3:o:automationdirect:p3-530_firmware:4.1.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8277A48-94C7-40F3-A822-F6311B2CDA94"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:p3-530:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D58D4140-C719-4EDA-8963-667F9FF21970"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:p2-550_firmware:1.2.10.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAF96AFD-40E3-4FB6-BAD7-067D9E257A08"
            },
            {
              "criteria": "cpe:2.3:o:automationdirect:p2-550_firmware:4.1.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D476CC45-B4A1-4210-9347-9854BB0A86AA"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:p2-550:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "386D70E8-70D6-4D25-818C-2218E1B1AC6C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:p1-550_firmware:1.2.10.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B7F3A1F-BD96-49A7-A340-0E5E1893326C"
            },
            {
              "criteria": "cpe:2.3:o:automationdirect:p1-550_firmware:4.1.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27710A58-507C-43BB-849F-7238F5D6D9ED"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:p1-550:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8FAF2C99-BC5F-4E99-A3A8-FBBDDC24C933"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:p1-540_firmware:1.2.10.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01C6DFFC-374B-4314-9230-53BD01BD6574"
            },
            {
              "criteria": "cpe:2.3:o:automationdirect:p1-540_firmware:4.1.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51095762-A87C-4A1D-A4E2-679462DC8FA9"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:p1-540:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4DB6B9FC-390E-43FD-9DF9-AAB1A9CDAA48"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}