Rockwell Automation Arena® Simulation Out of Bounds Read Vulnerability
CVE-2023-27854

7.8HIGH

Key Information:

Vendor
Rockwell Automation
Status
Arena Simulation
Vendor
CVE Published:
27 October 2023

Summary

An arbitrary code execution vulnerability in Arena Simulation allows an attacker to exploit a memory buffer overflow, potentially executing unauthorized code on affected systems. This can significantly compromise the confidentiality, integrity, and availability of the software. To become a victim, a user must open a specially crafted file from an untrusted source. Immediate action is advised to mitigate risks associated with this vulnerability.

Affected Version(s)

Arena Simulation All versions before 16.20.02 Patch

References

https://rockwellautomation.custhelp.com/app/answers/answe...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

These vulnerabilities were reported to Rockwell Automation by Michael Heinzl.
.