CVE-2024-21919: Rockwell Automation Arena Simulation Vulnerable To Uninitialized Pointer
First published: Tue Mar 26 2024(Updated: )
An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwell Automation | >=16.00.00<16.20.03 |
Remedy
Update to v16.20.03
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-21919?
CVE-2024-21919 is rated as a critical vulnerability due to the potential for unauthorized code execution.
How do I fix CVE-2024-21919?
To fix CVE-2024-21919, update Rockwell Automation Arena software to version 16.20.03 or later.
What systems are affected by CVE-2024-21919?
CVE-2024-21919 affects Rockwell Automation Arena versions from 16.00.00 up to but not including 16.20.03.
What can a threat actor do if they exploit CVE-2024-21919?
If exploited, a threat actor can execute unauthorized code on the affected system, potentially leading to data compromise or other harmful actions.
Is there a workaround for CVE-2024-21919?
Currently, there are no known workarounds for CVE-2024-21919, so applying the software update is essential.
- agent/weakness
- agent/remedy
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/rockwellautomation
- canonical/rockwell automation
- version/rockwell automation/16.00.00