High severity · published Mar 26, 2024
CVE-2024-21913
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arena · Rockwellautomation
16.00.00 before 16.20.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21913
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21913
Broken Link
https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
More from Arena
9.8
CVE-2023-29461
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit…
9.8
CVE-2023-29460
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit…
8.8
CVE-2023-29462
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit…
7.8
CVE-2025-7033
A memory abuse issue exists in the Rockwell Automation Arena® Simulation
7.8
CVE-2025-7032
A memory abuse issue exists in the Rockwell Automation Arena® Simulation
