CVE-2024-23601
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: CNA (Secondary)
Description
A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected (12)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.2.10.9 |
| Running on/with | Platform Versions |
|---|---|
Automationdirect P3 550e | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.2.10.9 |
| Running on/with | Platform Versions |
|---|---|
Automationdirect P3 550 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.2.10.9 |
| Running on/with | Platform Versions |
|---|---|
Automationdirect P3 530 | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.2.10.10 |
| Running on/with | Platform Versions |
|---|---|
Automationdirect P2 550 | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.2.10.10 |
| Running on/with | Platform Versions |
|---|---|
Automationdirect P1 550 | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.2.10.10 |
| Running on/with | Platform Versions |
|---|---|
Automationdirect P1 540 | All versions |
Related CWEs
CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
References (6)
Source: talos-cna@cisco.com
Vendor Advisory
Source: talos-cna@cisco.com
Third Party Advisory
Source: talos-cna@cisco.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Timeline
No history available yet.