Vulnerability · Published Jul 9, 2025 · Assigned by Rockwell
CVE-2025-6377Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
High 7.1
In plain English
A high-severity improper input validation in Arena® from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | Arena® | <=16.20.08 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N