CVE-2025-6376: Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rockwell Automation Arena® Simulationto a version that resolves this vulnerability.Fixed in 16.20.09
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6376?
CVE-2025-6376 is classified as a critical vulnerability due to its ability to allow remote code execution.
How does CVE-2025-6376 work?
CVE-2025-6376 exploits a vulnerability where a crafted DOE file can cause Arena Simulation to write beyond the allocated memory boundaries.
What versions of Rockwell Automation Arena Simulation are affected by CVE-2025-6376?
CVE-2025-6376 affects all versions of Rockwell Automation Arena Simulation that process DOE files.
How do I fix CVE-2025-6376?
To fix CVE-2025-6376, update Rockwell Automation Arena Simulation to the latest version that addresses this vulnerability.
What should I do if I receive a suspicious DOE file related to CVE-2025-6376?
If you receive a suspicious DOE file, do not open it and report it to your security team to mitigate potential risks associated with CVE-2025-6376.