CVE-2024-21920

Summary

A memory buffer vulnerability in Rockwell Automation Arena Simulation could potentially let a threat actor read beyond the intended memory boundaries. This could reveal sensitive information and even cause the application to crash, resulting in a denial-of-service condition. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Affected Software

Weaknesses

• CWE-125: CWE-125 Out-of-bounds Read

Workarounds

• Do not open untrusted files from unknown sources.
• For information on how to mitigate Security Risks on industrial automation control systems, we encourage customers to implement our suggested security best practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight  to minimize the risk of the vulnerability.

ADP Enrichment

CVE Program Container

Additional References

• https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html

• ←Previous
• Next→