PatchSiren cyber security CVE debrief

CVE-2024-9508 Horner Automation CVE debrief

A memory corruption vulnerability in Horner Automation Cscape (versions ≤10.0.363.1) enables local attackers to disclose sensitive information and execute arbitrary code. The flaw requires local access and user interaction, with HIGH impacts to confidentiality, integrity, and availability per CVSS 3.1 scoring. CISA published this advisory on December 10, 2024, as ICSA-24-345-05. The vendor has released Cscape v10 SP1 to remediate this issue. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: Horner Automation
Product: Cscape
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-12-10
Original CVE updated: 2024-12-10
Advisory published: 2024-12-10
Advisory updated: 2024-12-10

Who should care

OT/ICS security teams, plant engineers, automation specialists, and organizations using Horner Automation Cscape for PLC programming and HMI development should prioritize patching. Critical infrastructure operators in manufacturing, water/wastewater, energy, and building automation sectors relying on Horner controllers are particularly affected.

Technical summary

The vulnerability stems from memory corruption within the Cscape software, which is used for programming Horner Automation programmable logic controllers (PLCs) and operator interfaces. An attacker with local access who can convince a user to interact with a malicious file or resource could trigger the corruption, leading to information disclosure and arbitrary code execution in the context of the Cscape process. The attack complexity is low, requiring no privileges but user interaction. CVSS 3.1 score of 7.8 reflects high impacts across confidentiality, integrity, and availability. The vendor fix upgrades the software to v10 SP1, which addresses the underlying memory safety issue.

Defensive priority

HIGH

Recommended defensive actions

Update Cscape to v10 SP1 or later immediately
Restrict local access to engineering workstations running Cscape
Implement application whitelisting on OT/ICS engineering hosts
Monitor for unauthorized Cscape process execution or unexpected file modifications
Validate integrity of Cscape project files before opening
Segment engineering workstations from operational OT networks per ICS-CERT guidance

Evidence notes

Advisory ICSA-24-345-05 confirms affected versions and vendor fix availability. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector with user interaction required.

Official resources

2024-12-10