Memory Corruption Vulnerability in Rockwell Automation Arena Products
CVE-2024-12672

7.3HIGH

Key Information:

Vendor
Rockwell Automation
Status
Arena®
Vendor
CVE Published:
19 December 2024

Summary

CVE-2024-12672 identifies a severe memory corruption vulnerability within Rockwell Automation's Arena® software. This flaw allows a malicious actor to write data beyond allocated memory boundaries in a DOE file. Successful exploitation requires a legitimate user to execute a specially crafted payload, potentially enabling arbitrary code execution. Organizations utilizing affected versions of Arena® should promptly apply security patches to mitigate the risk associated with this vulnerability.

Affected Version(s)

Arena® All versions 16.20.06 and prior

References

https://www.rockwellautomation.com/en-us/trust-center/sec...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.