How severe is CVE-2024-24851?

CVE-2024-24851 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-24851 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-24851?

CVE-2024-24851 primarily affects Automationdirect P3-550e Firmware. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-24851?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-24851 have an EU (EUVD) identifier?

Yes. CVE-2024-24851 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-22214.

When was CVE-2024-24851 published?

CVE-2024-24851 was published on 2024-05-28 and last updated on 2026-06-17.

CVE-2024-24851

CVE-2024-24851 is a high-severity vulnerability in Automationdirect P3-550e Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-805.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (70th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-22214
Weakness: CWE-805
Affected product: Automationdirect P3-550e Firmware
Published: 2024-05-28
Last modified: 2026-06-17

Description

A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.

Frequently asked questions

What is CVE-2024-24851?: A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.
How severe is CVE-2024-24851?: CVE-2024-24851 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-24851 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-24851?: CVE-2024-24851 primarily affects Automationdirect P3-550e Firmware. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-24851?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-24851 have an EU (EUVD) identifier?: Yes. CVE-2024-24851 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-22214.
When was CVE-2024-24851 published?: CVE-2024-24851 was published on 2024-05-28 and last updated on 2026-06-17.

References

Affected products (12)

cpe:2.3:o:automationdirect:p3-550e_firmware:1.2.10.9:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p3-550e_firmware:4.1.1.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p3-550_firmware:1.2.10.9:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p3-550_firmware:4.1.1.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p3-530_firmware:1.2.10.9:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p3-530_firmware:4.1.1.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p2-550_firmware:1.2.10.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p2-550_firmware:4.1.1.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p1-550_firmware:1.2.10.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p1-550_firmware:4.1.1.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p1-540_firmware:1.2.10.10:*:*:*:*:*:*:*
cpe:2.3:o:automationdirect:p1-540_firmware:4.1.1.10:*:*:*:*:*:*:*

More vulnerabilities in Automationdirect P3-550e Firmware

CVE-2024-24963 — Critical (CVSS 9.8): A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of…
CVE-2024-24962 — Critical (CVSS 9.8): A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of…
CVE-2024-23601 — Critical (CVSS 9.8): A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A…
CVE-2024-21785 — Critical (CVSS 9.8): A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E…
CVE-2024-22187 — Critical (CVSS 9.1): A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality…
CVE-2024-24959 — High (CVSS 8.2): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality…

All CVEs affecting Automationdirect P3-550e Firmware →

Other CWE-805 vulnerabilities

CVE-2020-14509 — Critical (CVSS 9.8): Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser…
CVE-2025-20315 — High (CVSS 8.6): A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an…
CVE-2026-53016 — High (CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher…
CVE-2025-38743 — High (CVSS 7.8): Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value…
CVE-2025-20175 — High (CVSS 7.7): A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,…
CVE-2025-20174 — High (CVSS 7.7): A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,…

Browse all CWE-805 vulnerabilities →