Rockwell Automation Arena Simulation

🗓️ 26 Mar 2024 06:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 48 Views

Rockwell Automation Arena Simulation Software v16.00 has Out-of-bounds Write, Heap-based Buffer Overflow, and Improper Restriction of Operations vulnerabilities. Exploitation may crash the application or allow harmful code execution.

Reporter	Title	Published	Views	Family All 55
BDU FSTEC	The vulnerability of the Arena Simulation software in terms of modeling and automating discrete events lies in its memory management after it is freed. This allows a hacker to execute arbitrary code.	2 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The software for simulation and automation of discrete events in Arena Simulation is vulnerable due to an operation that goes beyond the buffer in memory, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	2 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The software’s vulnerability for simulating and automating discrete events in Arena Simulation arises from buffer overflows, allowing intruders to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of protected information.	2 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Arena Simulation software for modeling and automating discrete events lies in the use of an uninitialized pointer on the stack, which allows a hacker to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of the protected information.	2 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Arena Simulation software in simulating and automating discrete events lies in its ability to read data beyond the buffer in memory. This allows attackers to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of the protected information.	2 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Arena Simulation software in simulating and automating discrete events lies in its ability to read data beyond the specified buffer limit. This allows attackers to disclose sensitive information or cause the application to terminate abnormally.	2 Apr 202400:00	–	bdu_fstec
CNNVD	Rockwell Automation Arena Simulation Software 缓冲区错误漏洞	26 Mar 202400:00	–	cnnvd
CNNVD	Rockwell Automation Arena Simulation Software 缓冲区错误漏洞	26 Mar 202400:00	–	cnnvd
CNNVD	Rockwell Automation Arena Simulation Software 缓冲区错误漏洞	26 Mar 202400:00	–	cnnvd
CNNVD	Rockwell Automation Arena Simulation Software 缓冲区错误漏洞	26 Mar 202400:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-086-03.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-24-086-03
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/topics/industrial-control-systems
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

26 Mar 2024 06:00Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.8

EPSS0.00018

SSVC