High severity · published Mar 26, 2024
CVE-2024-21918
A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory and triggering an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arena · Rockwellautomation
16.00.00 before 16.20.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21918
Broken Link
https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html
More from Arena
9.8
CVE-2023-29461
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit…
9.8
CVE-2023-29460
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit…
8.8
CVE-2023-29462
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit…
7.8
CVE-2025-7033
A memory abuse issue exists in the Rockwell Automation Arena® Simulation
7.8
CVE-2025-7032
A memory abuse issue exists in the Rockwell Automation Arena® Simulation
