Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

XINJE XL5E-16T and XD5E-24R-E PLCs can crash when receiving a specific Modbus message

CVE-2024-50954 · published 1 year ago
Summary

XINJE XL5E-16T and XD5E-24R-E programmable logic controllers in versions V3.5.3b-V3.7.2a may crash when receiving a specific type of message on a local network. This can cause the PLC to stop working, requiring a restart. To avoid this issue, update the controller to the latest version or configure the network to block the malicious message.

Original advisory text
The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of cont...
The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of controllers within a local area network (LAN), sending a specific Modbus message to the controller can cause the PLC to crash, interrupting the normal operation of the programs running in the PLC. This results in the ERR indicator light turning on and the RUN indicator light turning off.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-703Improper Check or Handling of Exceptional Conditions
Timeline
Published15 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-50954 · NVD
Track software like this
Free during beta