CVE-2024-11157: rockwell automation arena Out-of-bounds Write

Vulnerability summary

CVE-2024-11157 is a high (CVSS 8.5) Out-of-bounds Write vulnerability in rockwell automation arena. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.

Timeline

1. 19-12-2024
   PublishedVulnerability first disclosed.
2. 13-03-2025
   Last modifiedVulnerability information updated.

Description

A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.