CVE-2025-6376: fallo de gravedad alta en Rockwell Automation Arena®
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.2%
A remote
code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE
file can force Arena Simulation to write beyond the boundaries of an allocated
object. Exploitation
requires user interaction, such as opening a malicious file within the software.
If exploited, a threat actor could execute arbitrary code on the target system.
The software must run under the context of the administrator in order to cause
worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Rockwell Automation · Arena®CVEs relacionadas — Rockwell Automation Arena®
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-11364HIGHRockwell Automation Third Party Vulnerability in Arena®EPSS 0.3%CVE-2025-3289HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-3287HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-3288HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-3286HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-3285HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%