PT-2023-8024 · Rockwell Automation · Arena Simulation

CVE-2023-29460 · Publicado 2023-05-09 · Atualizado 2024-12-17

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation Arena Simulation (affected versions not specified)

Description The issue is related to an arbitrary code execution vulnerability in Rockwell Automation's Arena Simulation software. This vulnerability could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow, resulting in a complete loss of confidentiality, integrity, and availability. The vulnerability is also described as a buffer overflow issue that could allow a remote attacker to execute arbitrary code. Additionally, it is mentioned as a use-after-free and out-of-bounds write remote code execution vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2023-09146

CVE-2023-29460

ZDI-23-1898

ZDI-23-1899

ZDI-23-610

Produtos afetados

Arena Simulation

Referências · 9

• https://t.me/cvenotify/104551 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-29460 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-23-610 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-09146 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-29460 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-1899 · Nota de Segurança
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391 · Aviso do Fabricante
• https://t.me/cibsecurity/63622 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-1898 · Nota de Segurança