Description
A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
Published: 2025-04-08
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Corrected in v.16.20.09 and later.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-10267 A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00024}

 epss

{'score': 0.00015}

Mon, 14 Jul 2025 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Rockwellautomation
Rockwellautomation arena
Weaknesses CWE-824
CPEs cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*
Vendors & Products Rockwellautomation
Rockwellautomation arena
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Wed, 09 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Apr 2025 15:30:00 +0000

Type Values Removed Values Added
Description A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
Title Local Code Execution Vulnerability in Arena®
Weaknesses CWE-457
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rockwellautomation Arena
cve-icon MITRE

Status: PUBLISHED

Assigner: Rockwell

Published:

Updated: 2025-04-09T13:12:00.236Z

Reserved: 2025-03-13T16:24:57.113Z

Link: CVE-2025-2287

cve-icon Vulnrichment

Updated: 2025-04-09T13:11:56.564Z

cve-icon NVD

Status : Analyzed

Published: 2025-04-08T16:15:26.620

Modified: 2025-07-14T19:14:12.453

Link: CVE-2025-2287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses