Rockwellautomation Arena vulnerabilities

CVE-2019-13510 [HIGH] CWE-416 CVE-2019-13510: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code.

CVE-2023-29460 [CRITICAL] CWE-125 CVE-2023-29460: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation softwa An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow potentially resulting in a complete loss of confidentiality, integrity, and availability.

CVE-2023-29461 [CRITICAL] CWE-125 CVE-2023-29461: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation softwa An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. potentially resulting in a complete loss of confidentiality, integrity, and availabil

CVE-2023-29462 [HIGH] CWE-787 CVE-2023-29462: An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation softwa An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. potentially resulting in a complete loss of confidentiality, integrity, and availability.

CVE-2024-11155 [HIGH] CWE-416 CVE-2024-11155: A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execu

CVE-2019-13521 [HIGH] CWE-357 CVE-2019-13521: A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simul A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.

CVE-2019-13519 [HIGH] CWE-843 CVE-2019-13519: A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simul A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.

CVE-2024-11156 [HIGH] CWE-787 CVE-2024-11156: An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® t An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malici

CVE-2025-6377 [HIGH] CWE-20 CVE-2025-6377: A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. T

CVE-2025-6376 [HIGH] CWE-20 CVE-2025-6376: A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. T

CVE-2019-13527 [HIGH] CWE-824 CVE-2019-13527: In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a mali In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized.

CVE-2026-8085 [HIGH] CWE-787 CVE-2026-8085: A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the mod A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by

CVE-2026-8314 [HIGH] CWE-787 CVE-2026-8314: A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the sim A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by

CVE-2026-8313 [HIGH] CWE-787 CVE-2026-8313: A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the lin A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by

CVE-2026-8312 [HIGH] CWE-787 CVE-2026-8312: A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the exp A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by

CVE-2025-3289 [HIGH] CWE-787 CVE-2025-3289: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based m A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE

CVE-2025-3287 [HIGH] CWE-125 CVE-2025-3287: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based m A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE

CVE-2024-12130 [HIGH] CWE-125 CVE-2024-12130: An “out of bounds read” code execution vulnerability exists in the Rockwell Automation Arena® that An “out of bounds read” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to read beyond the boundaries of an allocated memory. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitima

CVE-2025-2288 [HIGH] CWE-787 CVE-2025-2288: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a leg

CVE-2025-2293 [HIGH] CWE-787 CVE-2025-2293: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a leg