PT-2024-2517 · Rockwell Automation · Rockwell Automation Arena Simulation

Michael Heinzl · Published 2024-03-26 · Updated 2024-12-17 · CVE-2024-21913

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Arena Simulation (affected versions not specified)

Description A heap-based memory buffer overflow vulnerability could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system, affecting the confidentiality, integrity, and availability of the product. This can be triggered by opening a malicious file shared by the threat actor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-02498

CVE-2024-21913

Affected Products

Rockwell Automation Arena Simulation

References · 9

• https://osv.dev/vulnerability/CVE-2024-21913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21913 · Security Note
• https://bdu.fstec.ru/vul/2024-02498 · Security Note
• https://rockwellautomation.com/en-us/support/advisory.SD-1665.html · Note
• https://twitter.com/dailycve/status/1866159565525410144 · Twitter Post
• https://twitter.com/CVEnew/status/1772652978929049863 · Twitter Post
• https://twitter.com/RedPacketSec/status/1772928298055536869 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1772692324214022175 · Twitter Post
• https://t.me/cvenotify/74708 · Telegram Post