Description
Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
Published: 2024-12-19
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

V16.20.07 and later

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-50649 Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00012}

 epss

{'score': 0.00014}

Fri, 10 Jan 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Rockwellautomation
Rockwellautomation arena
Weaknesses CWE-416
CPEs cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*
Vendors & Products Rockwellautomation
Rockwellautomation arena
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 24 Dec 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Dec 2024 21:15:00 +0000

Type Values Removed Values Added
Title Rockwell Automation Third Party Vulnerability in Arena® Rockwell Automation Code Execution Vulnerability in Arena

Thu, 19 Dec 2024 21:00:00 +0000

Type Values Removed Values Added
Description Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
Title Rockwell Automation Third Party Vulnerability in Arena®
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rockwellautomation Arena
cve-icon MITRE

Status: PUBLISHED

Assigner: Rockwell

Published:

Updated: 2025-03-13T16:14:52.654Z

Reserved: 2024-12-04T15:39:03.203Z

Link: CVE-2024-12175

cve-icon Vulnrichment

Updated: 2024-12-24T16:39:31.708Z

cve-icon NVD

Status : Modified

Published: 2024-12-19T21:15:07.530

Modified: 2025-03-13T17:15:25.333

Link: CVE-2024-12175

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses