Local Code Execution Vulnerability in Rockwell Automation Arena Software

CVE-2025-3285

Summary

A local code execution vulnerability in Rockwell Automation's Arena software allows threat actors to exploit improper validation of user-supplied data. By manipulating the software, an attacker can potentially read outside the allocated memory buffer, leading to unauthorized access and execution of arbitrary code. This vulnerability necessitates that a legitimate user opens a specially crafted DOE file, thereby enabling exploitation. Organizations using Arena should review their security measures to mitigate risks associated with this vulnerability.

References