High severity · published Mar 26, 2024
CVE-2024-21913
Rockwell Automation Arena Simulation Vulnerable To Memory Corruption
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Arena Simulation · Rockwell Automation
Version 16.00 - 16.20.02 · source: vendor
AR
Arena · Rockwellautomation
16.00.00 before 16.20.03 · source: NVD
AS
Arena Simulation Software · Rockwellautomation
16.00 through 16.20.02 · source: CISA
Affected product
AS
Arena Simulation
Rockwell Automation
More from Arena Simulation
7.8
CVE-2025-7033
Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation
7.8
CVE-2025-7032
Rockwell Automation Stack-based Buffer Overflow In Arena® Simulation
7.8
CVE-2025-7025
Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation
7.8
CVE-2024-2929
Rockwell Automation Arena Simulation Vulnerable To Memory Corruption
7.8
CVE-2024-21919
Rockwell Automation Arena Simulation Vulnerable To Uninitialized Pointer