cbcvebase.
CVE-2024-24946
published 2024-05-28

CVE-2024-24946: A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A…

PriorityP345high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.78%
51.5th percentile
A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb686c` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.

Affected

13 ranges
VendorProductVersion rangeFixed in
automationdirectp1-540_firmware——
automationdirectp1-540_firmware——
automationdirectp1-550_firmware——
automationdirectp1-550_firmware——
automationdirectp2-550_firmware——
automationdirectp2-550_firmware——
automationdirectp3-530_firmware——
automationdirectp3-530_firmware——
automationdirectp3-550_firmware——
automationdirectp3-550_firmware——
automationdirectp3-550e——
automationdirectp3-550e_firmware——
automationdirectp3-550e_firmware——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.