PT-2025-15451 · Rockwell Automation · Rockwell Automation Arena

Michael Heinzl · Published 2025-04-07 · Updated 2025-07-14 · CVE-2025-2829

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena (affected versions not specified)

Description: A local code execution issue exists due to improper validation of user-supplied data, allowing a threat actor to write outside of the allocated memory buffer. If exploited, this can lead to information disclosure and execution of arbitrary code on the system. The issue can be triggered by opening a malicious DOE file.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-04774

CVE-2025-2829

Affected Products

Rockwell Automation Arena

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-2829 · Security Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2829 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04774 · Security Note
• https://twitter.com/CVEnew/status/1909631344168042782 · Twitter Post
• https://twitter.com/CveFindCom/status/1909630639772512697 · Twitter Post
• https://t.me/cvenotify/128925 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2025041437 · Note