Log in Start free

Vulnerability · Published Oct 27, 2023 · Assigned by Rockwell

CVE-2023-27854Rockwell Automation Arena® Simulation Out of Bounds Read Vulnerability

High 7.8

In plain English

A high-severity out-of-bounds read in Arena Simulation from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Affected products (as reported)

VendorProductVersions
Rockwell Automation Arena Simulation All versions before 16.20.02 Patch

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References