What’s Vulnerable › Vulnerabilities

CVE-2023-27854: Rockwell Automation Arena® Simulation Out of Bounds Read Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-27 · updated 2026-06-17
• Weakness: CWE-125

Description

An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Affected products

• Rockwell Automation Arena®: before 16.20.02 — fixed in 16.20.02

How to fix

Upgrade to a fixed version: Rockwell Automation Arena® 16.20.02. Check the vendor advisory for mitigations.

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145

Get alerted when CVE-2023-27854 or the next vulnerability affects your stack