Description
A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
Published: 2024-12-19
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

V16.20.07 and later

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-34318 A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00011}

 epss

{'score': 0.00012}

Tue, 21 Jan 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Rockwellautomation
Rockwellautomation arena
Weaknesses CWE-787
CPEs cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*
Vendors & Products Rockwellautomation
Rockwellautomation arena
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Tue, 24 Dec 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Dec 2024 21:00:00 +0000

Type Values Removed Values Added
Description A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
Title Rockwell Automation Third Party Vulnerability in Arena
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rockwellautomation Arena
cve-icon MITRE

Status: PUBLISHED

Assigner: Rockwell

Published:

Updated: 2025-03-13T15:37:28.015Z

Reserved: 2024-11-12T17:53:12.233Z

Link: CVE-2024-11157

cve-icon Vulnrichment

Updated: 2024-12-24T16:40:28.214Z

cve-icon NVD

Status : Modified

Published: 2024-12-19T21:15:07.283

Modified: 2025-03-13T16:15:15.230

Link: CVE-2024-11157

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses