Rockwell Automation Arena Out-of-Bounds Read Vulnerability Leading to Local Code Execution

A local code execution vulnerability has been identified in Rockwell Automation Arena versions through 16.20.08. This vulnerability arises from improper validation of user-supplied data, allowing a threat actor to read outside the allocated memory buffer. Exploitation of this flaw could lead to the disclosure of information and the execution of arbitrary code on the affected system. To successfully exploit this vulnerability, a legitimate user must open a malicious DOE file.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure and the execution of arbitrary code on the affected system.

Remediation

Users can upgrade to Arena version 16.20.09 to address this vulnerability. For those unable to upgrade, Rockwell Automation recommends applying general security best practices where possible.