Rockwell Automation Arena Local Code Execution Vulnerability

A local code execution vulnerability has been identified in Rockwell Automation Arena versions through 16.20.08. This vulnerability arises from an uninitialized pointer, which results in improper validation of user-supplied data. Exploitation of this flaw allows a threat actor to disclose information and execute arbitrary code on the system. To trigger this vulnerability, a legitimate user must open a malicious DOE file.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure and the execution of arbitrary code on the affected system.

Remediation

Users can upgrade to Arena version 16.20.09 to address this vulnerability. For those unable to upgrade, it is recommended to follow general security best practices.