Log in Start free

Vulnerability · Published Oct 27, 2023 · Assigned by Rockwell

CVE-2023-27858Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability

High 7.8

In plain English

A high-severity security flaw in Arena Simulation from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Affected products (as reported)

VendorProductVersions
Rockwell Automation Arena Simulation All versions before the 16.20.02 Patch

Weakness: CWE-824 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References