Read the docs
TI-2024-14467 Aliases CVE-2024-21785

A leftover debug code vulnerability exists in the Telnet Diagnostic Interface…

Priority HIGH 82CWE-489Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of network requests can lead to unauthorized access. An attacker can send a sequence of requests to trigger this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01512 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutomationDirectP3-550E1.2.10.9—No fix listedCNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:*1.2.10.9VulnerableAutomationDirect
cpe:2.3:o:automationdirect:p3-550e_firmware:4.1.1.10:*:*:*:*:*:*:*4.1.1.10VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p3-550e:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
cpe:2.3:o:automationdirect:p3-550_firmware:1.2.10.9:*:*:*:*:*:*:*1.2.10.9VulnerableAutomationDirect
cpe:2.3:o:automationdirect:p3-550_firmware:4.1.1.10:*:*:*:*:*:*:*4.1.1.10VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p3-550:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
cpe:2.3:o:automationdirect:p3-530_firmware:1.2.10.9:*:*:*:*:*:*:*1.2.10.9VulnerableAutomationDirect
cpe:2.3:o:automationdirect:p3-530_firmware:4.1.1.10:*:*:*:*:*:*:*4.1.1.10VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p3-530:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
cpe:2.3:o:automationdirect:p2-550_firmware:1.2.10.10:*:*:*:*:*:*:*1.2.10.10VulnerableAutomationDirect
  • cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:* Versions 1.2.10.9 Vulnerable ·AutomationDirect
  • cpe:2.3:o:automationdirect:p3-550e_firmware:4.1.1.10:*:*:*:*:*:*:* Versions 4.1.1.10 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p3-550e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
  • cpe:2.3:o:automationdirect:p3-550_firmware:1.2.10.9:*:*:*:*:*:*:* Versions 1.2.10.9 Vulnerable ·AutomationDirect
  • cpe:2.3:o:automationdirect:p3-550_firmware:4.1.1.10:*:*:*:*:*:*:* Versions 4.1.1.10 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p3-550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
  • cpe:2.3:o:automationdirect:p3-530_firmware:1.2.10.9:*:*:*:*:*:*:* Versions 1.2.10.9 Vulnerable ·AutomationDirect
  • cpe:2.3:o:automationdirect:p3-530_firmware:4.1.1.10:*:*:*:*:*:*:* Versions 4.1.1.10 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p3-530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
  • cpe:2.3:o:automationdirect:p2-550_firmware:1.2.10.10:*:*:*:*:*:*:* Versions 1.2.10.10 Vulnerable ·AutomationDirect
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:automationdirect:p2-550_firmware:4.1.1.10:*:*:*:*:*:*:*4.1.1.10VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p2-550:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
cpe:2.3:o:automationdirect:p1-550_firmware:1.2.10.10:*:*:*:*:*:*:*1.2.10.10VulnerableAutomationDirect
cpe:2.3:o:automationdirect:p1-550_firmware:4.1.1.10:*:*:*:*:*:*:*4.1.1.10VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p1-550:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
cpe:2.3:o:automationdirect:p1-540_firmware:1.2.10.10:*:*:*:*:*:*:*1.2.10.10VulnerableAutomationDirect
cpe:2.3:o:automationdirect:p1-540_firmware:4.1.1.10:*:*:*:*:*:*:*4.1.1.10VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p1-540:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
  • cpe:2.3:o:automationdirect:p2-550_firmware:4.1.1.10:*:*:*:*:*:*:* Versions 4.1.1.10 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p2-550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
  • cpe:2.3:o:automationdirect:p1-550_firmware:1.2.10.10:*:*:*:*:*:*:* Versions 1.2.10.10 Vulnerable ·AutomationDirect
  • cpe:2.3:o:automationdirect:p1-550_firmware:4.1.1.10:*:*:*:*:*:*:* Versions 4.1.1.10 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p1-550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
  • cpe:2.3:o:automationdirect:p1-540_firmware:1.2.10.10:*:*:*:*:*:*:* Versions 1.2.10.10 Vulnerable ·AutomationDirect
  • cpe:2.3:o:automationdirect:p1-540_firmware:4.1.1.10:*:*:*:*:*:*:* Versions 4.1.1.10 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p1-540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21785

References

Exploit 2

Advisory 1

  • TI-2024-14780 Improper access control in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.1
  • TI-2024-16461 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-16460 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-15624 Insufficient verification of data authenticity in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-16368 Out-of-bounds write in AutomationDirect P3-550E CVSS 3.1HIGH 7.5
  • TI-2024-16453 Out-of-bounds write in AutomationDirect P3-550E CVSS 3.1HIGH 8.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences