CVE-2025-6377: Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.20.09
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6377?
CVE-2025-6377 is classified as a remote code execution vulnerability that poses serious risks if exploited.
How do I fix CVE-2025-6377?
To mitigate CVE-2025-6377, users should update to the latest version of Rockwell Automation Arena Simulation as specified in official advisories.
What are the consequences of exploiting CVE-2025-6377?
Exploitation of CVE-2025-6377 can result in unauthorized remote code execution, potentially compromising the system.
What causes CVE-2025-6377?
CVE-2025-6377 is caused by a crafted DOE file leading Arena Simulation to write beyond the allocated object boundaries.
Who is affected by CVE-2025-6377?
CVE-2025-6377 affects users of Rockwell Automation Arena Simulation who may open malicious DOE files.