CVE-2024-21912
Assigner: Rockwell
Published: 2024-03-26T15:34:35.837Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Arena Simulation
vendor: Rockwell Automation
versions: status: affected
version: Version 16.00 - 16.20.02
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Michael Heinzl
datePublic: 2024-03-26T14:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.</span>


value: 
An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.


impacts: capecId: CAPEC-100
descriptions: value: CAPEC-100 Overflow Buffers
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-787
description: CWE-787 Out-of-bounds Write
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to v16.20.03
value: Update to v16.20.03
source: discovery: UNKNOWN
title: Rockwell Automation Arena Simulation vulnerable to out of bounds write
x_generator: engine: Vulnogram 0.1.0-dev