Rockwell Automation Arena Local Code Execution Vulnerability

A local code execution vulnerability has been identified in Rockwell Automation Arena versions through 16.20.08. The issue arises from an uninitialized pointer, leading to improper validation of user-supplied data. This vulnerability allows a legitimate user to open a malicious DOE file, which could result in the disclosure of information and the execution of arbitrary code on the system.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure and the execution of arbitrary code on the affected system.

Remediation

Users can upgrade to Arena version 16.20.09 to address this vulnerability. For those unable to upgrade, Rockwell Automation recommends applying general security best practices where possible.