Rockwell Automation Arena Local Code Execution Vulnerability

A local code execution vulnerability has been identified in Rockwell Automation Arena versions through 16.20.08. This vulnerability arises from a stack-based memory buffer overflow, caused by improper validation of user-supplied data. Exploitation of this flaw allows a threat actor to disclose information and execute arbitrary code on the affected system. To successfully exploit this vulnerability, a legitimate user must open a malicious DOE file.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure and the execution of arbitrary code on the affected system.

Remediation

Users can upgrade to Rockwell Automation Arena version 16.20.09 to address this vulnerability. For those unable to upgrade, applying security best practices is recommended.