CVE-2024-24962 - OpenCVE

A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to stack-based buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.This CVE tracks the stack-based buffer overflow that occurs at offset `0xb6e98` of v1.2.10.9 of the P3-550E firmware.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-05-28T15:30:16.326Z

Updated: 2024-08-01T23:36:21.259Z

Reserved: 2024-02-01T20:45:31.233Z

Link: CVE-2024-24962

Vulnrichment

Updated: 2024-08-01T23:36:21.259Z

NVD

Status : Awaiting Analysis

Published: 2024-05-28T16:15:15.213

Modified: 2024-06-10T17:16:21.383

Link: CVE-2024-24962

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-24962", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-02-01T20:45:31.233Z", "datePublished": "2024-05-28T15:30:16.326Z", "dateUpdated": "2024-08-01T23:36:21.259Z"}, "containers": {"cna": {"affected": [{"vendor": "AutomationDirect", "product": "P3-550E", "versions": [{"version": "1.2.10.9", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to stack-based buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.This CVE tracks the stack-based buffer overflow that occurs at offset `0xb6e98` of v1.2.10.9 of the P3-550E firmware."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE", "cweId": "CWE-121"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-28T15:30:16.326Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939"}], "credits": [{"lang": "en", "value": "Discovered by Matt Wiseman of Cisco Talos."}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24962", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-28T17:33:37.881602Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:*"], "vendor": "automationdirect", "product": "p3-550e_firmware", "versions": [{"status": "affected", "version": "1.2.10.9"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:43:19.567Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.259Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.259Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24962", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-28T17:33:37.881602Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:*"], "vendor": "automationdirect", "product": "p3-550e_firmware", "versions": [{"status": "affected", "version": "1.2.10.9"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T17:24:05.220Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Matt Wiseman of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "AutomationDirect", "product": "P3-550E", "versions": [{"status": "affected", "version": "1.2.10.9"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939"}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to stack-based buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.This CVE tracks the stack-based buffer overflow that occurs at offset `0xb6e98` of v1.2.10.9 of the P3-550E firmware."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-28T15:30:16.326Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24962", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:36:21.259Z", "dateReserved": "2024-02-01T20:45:31.233Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-05-28T15:30:16.326Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}