Lucene search

K
cvelistRockwellCVELIST:CVE-2023-27858
HistoryOct 27, 2023 - 6:58 p.m.

CVE-2023-27858 Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability

2023-10-2718:58:26
CWE-824
Rockwell
www.cve.org
1
cve-2023-27858
rockwell automation arena simulation
uninitialized pointer
arbitrary code execution
unauthorized code
confidentiality
integrity
availability
malicious file

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.3%

Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Arena Simulation",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "All versions before the 16.20.02 Patch"
      }
    ]
  }
]

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.3%

Related for CVELIST:CVE-2023-27858