CVE-2024-21919: rockwell automation arena simulation Access of Uninitialized Pointer
Vulnerability summary
CVE-2024-21919 is a high (CVSS 7.8) Access of Uninitialized Pointer vulnerability in rockwell automation arena simulation. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.
Timeline
- 26-03-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Rockwell automation1 product
- arena simulationVersion 16.00 - 16.20.02
Rockwellautomation1 product
- arena≥ 16.00.00, < 16.20.03
2 vendors · 2 products