AutomationDirect Productivity 3000 P3-550E 1.2.10.9 Programming Software Connection FileSelect stack-based overflow

Summaryinfo

A vulnerability was found in AutomationDirect Productivity 3000 P3-550E 1.2.10.9. It has been rated as critical. The affected element is the function FileSelect of the component Programming Software Connection. The manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2024-24963. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in AutomationDirect Productivity 3000 P3-550E 1.2.10.9 and classified as very critical. This issue affects the function FileSelect of the component Programming Software Connection. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to stack-based buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.This CVE tracks the stack-based buffer overflow that occurs at offset `0xb6e84` of v1.2.10.9 of the P3-550E firmware.

It is possible to read the advisory at cisa.gov. The identification of this vulnerability is CVE-2024-24963. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/13/2025).

Upgrading to version 4.2.0.x eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• AutomationDirect

Name

• Productivity 3000 P3-550E

Version

• 1.2.10.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion