CVE-2024-22187

An attacker sends a specially crafted network packet to the port serviced by the Remote Memory Diagnostics module in the control software (Programming Software Connection). This packet allows the attacker to control both the target address and the value written to device memory (hence the write-what-where designation). The lack of any authentication mechanism for this interface means the exploit does not require any credentials.

An attacker can overwrite arbitrary memory areas of the PLC controller, which may lead to disruption or complete shutdown of the industrial process, data integrity damage, and potentially malicious code execution on the device.

Apply patches available from the manufacturer according to references (AutomationDirect advisory SA00036 and Talos Intelligence report TALOS-2024-1940). Until updating, it is recommended to isolate P3-550/P3-550E devices from untrusted networks and restrict network access to diagnostic ports exclusively to authorized engineering stations using firewall or OT network segmentation.

AutomationDirect P3-550E with firmware version 1.2.10.9 and AutomationDirect P3-550 (firmware versions indicated in manufacturer references).