CVE-2024-21785

CRITICAL

AutomationDirect P3-550E <1.2.10.9 - Unauthorized Access

Title source: llm

Description

A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of network requests can lead to unauthorized access. An attacker can send a sequence of requests to trigger this vulnerability.

References (3)

[Vendor Advisory] https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003yaj2AA/sa00038

[Exploit, Third Party Advisory] https://talosintelligence.com/vulnerability_reports/TALOS-2024-1942

[Exploit, Third Party Advisory] https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1942

Scores

CVSS v3 9.8

EPSS 0.0100

EPSS Percentile 77.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-489

Status published

Products (12)

automationdirect/p1-540_firmware 1.2.10.10

automationdirect/p1-540_firmware 4.1.1.10

automationdirect/p1-550_firmware 1.2.10.10

automationdirect/p1-550_firmware 4.1.1.10

automationdirect/p2-550_firmware 1.2.10.10

automationdirect/p2-550_firmware 4.1.1.10

automationdirect/p3-530_firmware 1.2.10.9

automationdirect/p3-530_firmware 4.1.1.10

automationdirect/p3-550_firmware 1.2.10.9

automationdirect/p3-550_firmware 4.1.1.10

... and 2 more

Published May 28, 2024

Tracked Since Feb 18, 2026