CVE-2024-24946

Exp

A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb686c` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.

Published: 2024-05-28 Last update: 2025-02-12 Assigner: [email protected] Source: [email protected]

NVD Status：Analyzed，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2024-24946

EPSS CVSS CWE Exploit-DB Affected

Conclusion & alert: CVE-2024-24946 is rated High Exploit Risk (71.2/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.51%). Core evidence: 2 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2024-24946

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2024-24946

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-04-20	0.39%	0.51%	+0.12%
2	2026-03-23	0.47%	0.39%	-0.07%
3	2025-12-18	—	0.47%	—

Full EPSS history (11 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-24946

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.2	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	4.2	[email protected]

Weakness enumeration for CVE-2024-24946

CWE-787 MITRE ↗

Affected software / configurations for CVE-2024-24946

Vendor	Product	Version	Raw CPE
automationdirect	p3-550e_firmware	1.2.10.9	cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:::::::*
automationdirect	p3-550e_firmware	4.1.1.10	cpe:2.3:o:automationdirect:p3-550e_firmware:4.1.1.10:::::::*
automationdirect	p3-550_firmware	1.2.10.9	cpe:2.3:o:automationdirect:p3-550_firmware:1.2.10.9:::::::*
automationdirect	p3-550_firmware	4.1.1.10	cpe:2.3:o:automationdirect:p3-550_firmware:4.1.1.10:::::::*
automationdirect	p3-530_firmware	1.2.10.9	cpe:2.3:o:automationdirect:p3-530_firmware:1.2.10.9:::::::*
automationdirect	p3-530_firmware	4.1.1.10	cpe:2.3:o:automationdirect:p3-530_firmware:4.1.1.10:::::::*
automationdirect	p2-550_firmware	1.2.10.10	cpe:2.3:o:automationdirect:p2-550_firmware:1.2.10.10:::::::*
automationdirect	p2-550_firmware	4.1.1.10	cpe:2.3:o:automationdirect:p2-550_firmware:4.1.1.10:::::::*
automationdirect	p1-550_firmware	1.2.10.10	cpe:2.3:o:automationdirect:p1-550_firmware:1.2.10.10:::::::*
automationdirect	p1-550_firmware	4.1.1.10	cpe:2.3:o:automationdirect:p1-550_firmware:4.1.1.10:::::::*
automationdirect	p1-540_firmware	1.2.10.10	cpe:2.3:o:automationdirect:p1-540_firmware:1.2.10.10:::::::*
automationdirect	p1-540_firmware	4.1.1.10	cpe:2.3:o:automationdirect:p1-540_firmware:4.1.1.10:::::::*

References for CVE-2024-24946

URL	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1937	Exploit Third Party Advisory

cvelogic Threat Intelligence