CVE-2024-21913
Assigner: Rockwell
Published: 2024-03-26T15:38:23.962Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Arena Simulation
vendor: Rockwell Automation
versions: status: affected
version: Version 16.00 - 16.20.02
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Michael Heinzl
datePublic: 2024-03-26T14:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation.  Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.</span>


value: 
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation.  Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.


impacts: capecId: CAPEC-100
descriptions: value: CAPEC-100 Overflow Buffers
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-122
description: CWE-122 Heap-based Buffer Overflow
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to v16.20.03
value: Update to v16.20.03
source: discovery: UNKNOWN
title: Rockwell Automation Arena Simulation Vulnerable To Memory Corruption
x_generator: engine: Vulnogram 0.1.0-dev