CVE-2024-23601 – A critical code injection vulnerability in Auto... (How to Fix)

Q: What is the severity of CVE-2024-23601?

CVE-2024-23601 has a CVSS score of 9.8 (CRITICAL). A critical code injection vulnerability in AutomationDirect P3-550E's scan_lib.bin functionality allows attackers to execute arbitrary code by providing a malicious file. This affects P3-550E controllers running vulnerable firmware versions, potentially compromising industrial control systems.

📋 TL;DR

A critical code injection vulnerability in AutomationDirect P3-550E's scan_lib.bin functionality allows attackers to execute arbitrary code by providing a malicious file. This affects P3-550E controllers running vulnerable firmware versions, potentially compromising industrial control systems.

💻 Affected Systems

Products:

AutomationDirect P3-550E

Versions: 1.2.10.9 and potentially earlier versions

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the scan_lib.bin file processing functionality; exploitation requires ability to upload files to the device.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to take full control of the PLC, manipulate industrial processes, disrupt operations, or establish persistence in OT networks.

🟠

Likely Case

Remote code execution leading to process manipulation, data theft, or denial of service in industrial environments.

🟢

If Mitigated

Limited impact if proper network segmentation and file validation controls prevent malicious file uploads.

🌐 Internet-Facing: HIGH if devices are exposed to internet with vulnerable firmware and file upload capabilities enabled.

🏢 Internal Only: HIGH as attackers with network access can exploit this vulnerability to compromise critical industrial systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires file upload capability but no authentication; weaponization is likely given the critical nature and industrial control system impact.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor advisory for latest patched version

Vendor Advisory: https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003ycL2AQ/sa00039

Restart Required: Yes

Instructions:

1. Download latest firmware from AutomationDirect support portal. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Verify update completion and functionality.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate P3-550E devices in separate network segments with strict firewall rules

File Upload Restrictions

all

Implement strict controls on file uploads to PLC devices

🧯 If You Can't Patch

Implement strict network segmentation to isolate PLCs from untrusted networks
Deploy intrusion detection systems monitoring for suspicious file uploads to PLC devices

🔍 How to Verify

Check if Vulnerable:

Check firmware version via device web interface or programming software; version 1.2.10.9 is confirmed vulnerable

Check Version:

Check via device web interface or AutomationDirect programming software version display

Verify Fix Applied:

Verify firmware version has been updated to patched version provided by vendor

📡 Detection & Monitoring

Log Indicators:

Unexpected file uploads to scan_lib.bin
Firmware modification attempts
Unusual process execution on PLC

Network Indicators:

Suspicious file transfers to PLC IP addresses
Unexpected connections to PLC management interfaces

SIEM Query:

source="plc_logs" AND (event="file_upload" OR event="firmware_change") AND target="scan_lib.bin"

📊 Metadata

CVE ID: CVE-2024-23601

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-345

Published: May 28, 2024

Last Updated: February 12, 2025

🔗 References

https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003ycL2AQ/sa00039 Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1943 Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1943 Third Party Advisory
https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003ycL2AQ/sa00039 Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1943 Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1943 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-23601, you might also want to check these: