Critical ICSA-24-144-01 15 CVEs

AutomationDirect Productivity PLCs

Published May 23, 2024 · Updated May 23, 2024

Vendor: Automation Direct Product: Productivity 1000 P1-540 CPU Product: Productivity 1000 P1-550 CPU Product: Productivity 2000 P2-550 CPU Product: Productivity 3000 P3-530 CPU Product: Productivity 3000 P3-550 CPU Product: Productivity 3000 P3-550E CPU

Summary

Successful exploitation of these vulnerabilities could lead to remote code execution and denial of service.

Vulnerabilities 15

Critical 9.8

CVE-2024-21785

A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E…

Automation Direct P3-550E

May 28, 2024
Critical 9.8

CVE-2024-23601

A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A special…

Automation Direct P3-550E

May 28, 2024
Critical 9.8

CVE-2024-24962

A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of A…

Automation Direct P3-550E

May 28, 2024
Critical 9.8

CVE-2024-24963

A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of A…

Automation Direct P3-550E

May 28, 2024
Critical 9.1

CVE-2024-22187

A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality …

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24946

A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of Autom…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24947

A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of Autom…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24954

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24955

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24956

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24957

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24958

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…

Automation Direct P3-550E

May 28, 2024
High 8.2

CVE-2024-24959

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…

Automation Direct P3-550E

May 28, 2024
High 7.5

CVE-2024-23315

A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of Aut…

Automation Direct P3-550E

May 28, 2024
High 7.5

CVE-2024-24851

A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of Automa…

Automation Direct P3-550E

May 28, 2024

Revision history

2024-05-23 #1
Initial Publication

References

ICSA Advisory ICSA-24-144-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-144-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B