PT-2023-7184 · Rockwell Automation · Rockwell Automation Arena

Published 2023-05-09 · Updated 2024-12-17 · CVE-2023-29461

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation Arena (affected versions not specified)

Description The issue is related to a memory buffer overflow in the heap, allowing for arbitrary code execution. This could potentially result in a complete loss of confidentiality, integrity, and availability. The vulnerability can be exploited by a remote attacker, enabling them to execute unauthorized code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2023-08211

CVE-2023-29461

ZDI-23-612

Affected Products

Rockwell Automation Arena

References · 7

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139391 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29461 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08211 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29461 · Security Note
• https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1139391 · Note
• https://t.me/cibsecurity/63619 · Telegram Post