PT-2025-28960 · Rockwell Automation · Arena

Published 2025-07-09 · Updated 2025-08-13 · CVE-2025-6376

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena versions prior to 16.20.09

Description: A remote code execution issue exists in Rockwell Automation Arena. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, an attacker could execute arbitrary code on the target system. The software must run under the context of the administrator to cause a greater impact.

Recommendations: Update Rockwell Automation Arena to version 16.20.09. Avoid opening untrusted DOE files.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

BDU:2025-08441

CVE-2025-6376

ZDI-25-836

Affected Products

Arena

References · 9

• https://zerodayinitiative.com/advisories/ZDI-25-836 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6376 · Vendor Advisory
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1729.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6376 · Security Note
• https://bdu.fstec.ru/vul/2025-08441 · Security Note
• https://twitter.com/the_yellow_fall/status/1943955471670685810 · Twitter Post
• https://twitter.com/cracbot/status/1944713568466956571 · Twitter Post
• https://t.me/cvenotify/128635 · Telegram Post
• https://twitter.com/CVEnew/status/1943335891855880316 · Twitter Post