CVE-2024-24947
Description
A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb68c4` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| automationdirect p3-550e_firmware | 1.2.10.9, 4.1.1.10 | — |
| automationdirect p3-550_firmware | 1.2.10.9, 4.1.1.10 | — |
| automationdirect p3-530_firmware | 1.2.10.9, 4.1.1.10 | — |
| automationdirect p2-550_firmware | 1.2.10.10, 4.1.1.10 | — |
| automationdirect p1-550_firmware | 1.2.10.10, 4.1.1.10 | — |
| automationdirect p1-540_firmware | 1.2.10.10, 4.1.1.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.