CVE-2024-21913
published 2024-03-26CVE-2024-21913: A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert…
PriorityP338high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.24%
14.5th percentile
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rockwell_automation | arena_simulation | — | — |
| rockwellautomation | arena | >= 16.00.00 < 16.20.03 | 16.20.03 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Rockwell Automation Arena Simulation
cisa_ics·2024-03-26·CVSS 7.8
[HIGH] Rockwell Automation Arena Simulation
ICS Advisory
##
Rockwell Automation Arena Simulation
Release DateMarch 26, 2024
Alert CodeICSA-24-086-03
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: low attack complexity
- Vendor: Rockwell Automation
- Equipment: Arena Simulation Software
- Vulnerabilities: Out-of-bounds Write, Heap-based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use After Free, Access of Uninitialized Pointer, Out-of-bounds Read
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could crash the application or allow an attacker to run harmful code on the system.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Rockwell Automation reports that the following versions of Arena Simulation Software are affe
GHSA
GHSA-f86g-qrx4-c3h8: A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert
ghsa_unreviewed·2024-03-26
CVE-2024-21913 [HIGH] CWE-122 GHSA-f86g-qrx4-c3h8: A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-26
Published