What’s Vulnerable › Vulnerabilities

CVE-2023-27858: Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-27 · updated 2026-06-17
• Weakness: CWE-824

Description

Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Affected products

• Rockwell Automation Arena®: before 16.20.02 — fixed in 16.20.02

How to fix

Upgrade to a fixed version: Rockwell Automation Arena® 16.20.02. Check the vendor advisory for mitigations.

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145

Get alerted when CVE-2023-27858 or the next vulnerability affects your stack