Rockwell Automation Arena Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Rockwell Automation Arena Simulation versions 16.20.08 and earlier. The issue arises from improper input validation, allowing a crafted DOE file to cause the application to write outside the boundaries of an allocated object. Exploitation of this vulnerability requires user interaction, such as opening a malicious file within the software. If successfully exploited, a threat actor could execute arbitrary code on the target system, with the potential for more severe consequences if the software is running with administrative privileges.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users are advised to update to Arena Simulation version 16.20.09 or later. For those unable to upgrade, Rockwell Automation recommends applying security best practices.