A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
Existe un problema de seguridad de ejecución remota de código en Rockwell Automation Arena®. Un archivo DOE manipulado puede obligar a Arena Simulation a escribir más allá de los límites de un objeto asignado. Su explotación requiere la interacción del usuario, como abrir un archivo malicioso dentro del software. Si se explota, un atacante podría ejecutar código arbitrario en el sistema objetivo. El software debe ejecutarse bajo el contexto del administrador para causar un impacto aún mayor. Esto se refleja en la puntuación CVSS de Rockwell, como AT:P.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Attack Requirements | PRESENT |
| Privileges Required | NONE |
| User Interaction | ACTIVE |
| Vulnerability Confidentiality | HIGH |
| Vulnerability Integrity | HIGH |
| Vulnerability Availability | HIGH |
| Subsequent Confidentiality | NONE |
| Subsequent Integrity | NONE |
| Subsequent Availability | NONE |
Source: [email protected]
Type: Secondary
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-20
|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| rockwellautomation | arena | * | <built-in method update of dict object at 0x72a9ccfc7bc0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:* |