Read the docs
TI-2024-16456 Aliases CVE-2024-24956

Out-of-bounds write in AutomationDirect P3-550E

Priority MEDIUM 44CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb6a38`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutomationDirectP3-550E1.2.10.9—No fix listedCNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:*1.2.10.9VulnerableAutomationDirect
cpe:2.3:h:automationdirect:p3-550e:-:*:*:*:*:*:*:*not specified by NVDRunning onAutomationDirect
  • cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:* Versions 1.2.10.9 Vulnerable ·AutomationDirect
  • cpe:2.3:h:automationdirect:p3-550e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24956

References

Exploit 2

  • TI-2024-14467 A leftover debug code vulnerability exists in the Telnet Diagnostic Interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-14780 Improper access control in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.1
  • TI-2024-16461 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-16460 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-15624 Insufficient verification of data authenticity in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-16459 Out-of-bounds write in AutomationDirect P3-550E CVSS 3.1HIGH 8.2
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences