CVE-2024-24959

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb6c18`.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
AutomationDirect	P3-550E	1.2.10.9
automationdirect	p3-550e_firmware	1.2.10.9

References

https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938Exploit, Third Party Advisory

Timeline

Published: May 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-24965.5A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a h CVE-2024-249629.8A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-55 CVE-2024-249639.8A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-55 CVE-2024-249646.3Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2. If th CVE-2024-249665.5When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Softwar CVE-2024-249685.3Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a den CVE-2024-24977.2A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file i CVE-2024-249706.5Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driv CVE-2024-249726.5Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorise CVE-2024-249733.3Improper input validation for some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potenti CVE-2024-249747.5The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker CVE-2024-249756.5Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be process