PT-2019-13392 · Rockwell Automation · Arena Simulation

Kimiya · Published 2019-09-24 · Updated 2024-12-17 · CVE-2019-13527

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Arena Simulation Software Cat. 9502-Ax versions 16.00.00 and earlier

Description A maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized, potentially leading to remote code execution. The issue is related to the parsing of Arena Simulation DOE files.

Recommendations For versions 16.00.00 and earlier, update to a version later than 16.00.00 to resolve the issue. As a temporary workaround, consider avoiding the use of potentially malicious Arena files until a patch is available. Restrict access to untrusted Arena files to minimize the risk of exploitation.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2019-13527

ZDI-19-993

Affected Products

Arena Simulation

References · 5

• https://osv.dev/vulnerability/CVE-2019-13527 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-19-993 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-13527 · Security Note
• https://t.me/cvenotify/104548 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-19-213-05 · Note