Lucene search

K
vulnrichmentRockwellVULNRICHMENT:CVE-2023-27858
HistoryOct 27, 2023 - 6:58 p.m.

CVE-2023-27858 Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability

2023-10-2718:58:26
CWE-824
Rockwell
github.com
2
cve-2023
rockwell automation
arbitrary code execution
unauthorized code
uninitialized pointer
confidentiality
integrity
availability
malicious file
threat actor

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:rockwellautomation:arena_simulation:-:*:*:*:*:*:*:*"
    ],
    "vendor": "rockwellautomation",
    "product": "arena_simulation",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "16.20.02",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2023-27858