ZDI-CAN-24137: ZDI-24-1650: Rockwell Automation Arena Simulation DOE File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-11158.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-24137?
ZDI-CAN-24137 is a high-severity vulnerability that allows remote code execution on affected installations.
How do I fix ZDI-CAN-24137?
To fix ZDI-CAN-24137, update to the latest version of Rockwell Automation Arena Simulation as recommended by the vendor.
What are the risks of ZDI-CAN-24137?
The risks of ZDI-CAN-24137 include unauthorized remote code execution if a user interacts with a malicious page or file.
Who is affected by ZDI-CAN-24137?
Organizations using vulnerable versions of Rockwell Automation Arena Simulation are at risk from ZDI-CAN-24137.
What is required to exploit ZDI-CAN-24137?
To exploit ZDI-CAN-24137, an attacker needs user interaction, such as the target visiting a malicious page or opening a malicious file.