CVE-2024-36980
📋 TL;DR
An out-of-bounds read vulnerability in OpenPLC Runtime's EtherNet/IP PCCC parser allows attackers to cause denial of service via specially crafted network requests. This affects OpenPLC_v3 installations using EtherNet/IP communication. Industrial control systems using vulnerable OpenPLC versions are at risk.
💻 Affected Systems
- OpenPLC Runtime
📦 What is this software?
Openplc V3 Firmware by Openplcproject
⚠️ Risk & Real-World Impact
Worst Case
Complete PLC runtime crash leading to industrial process disruption, production downtime, and potential safety implications in critical infrastructure.
Likely Case
PLC runtime instability or crash causing temporary denial of service until manual restart, disrupting automated processes.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially causing only temporary service interruption.
🎯 Exploit Status
Proof of concept available in Talos advisory. Exploitation requires network access to EtherNet/IP port (typically 44818/tcp).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenPLC_v3 after commit b4702061dc14d1024856f71b4543298d77007b88
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2004
Restart Required: Yes
Instructions:
1. Update to latest OpenPLC_v3 version from GitHub repository. 2. Recompile and reinstall OpenPLC Runtime. 3. Restart the OpenPLC service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to EtherNet/IP port (44818/tcp) using firewall rules
iptables -A INPUT -p tcp --dport 44818 -j DROP
netsh advfirewall firewall add rule name="Block OpenPLC EtherNet/IP" dir=in action=block protocol=TCP localport=44818
Disable EtherNet/IP
allDisable EtherNet/IP communication if not required
Edit OpenPLC settings to disable EtherNet/IP protocol
🧯 If You Can't Patch
- Implement strict network access controls to EtherNet/IP port (44818/tcp)
- Deploy network intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check OpenPLC version: git log --oneline -1 | grep b4702061dc14d1024856f71b4543298d77007b88Check Version:
git log --oneline -1Verify Fix Applied:
Verify version is newer than commit b4702061dc14d1024856f71b4543298d77007b88📡 Detection & Monitoring
Log Indicators:
- OpenPLC runtime crashes
- EtherNet/IP parser errors
- Unexpected process termination
Network Indicators:
- Multiple malformed EtherNet/IP packets to port 44818
- Unusual traffic patterns to PLC network
SIEM Query:
source="openplc.log" AND ("crash" OR "segmentation fault" OR "out of bounds")