OTPulse

Rockwell Automation Arena

Plan PatchCVSS 7.8ICS-CERT ICSA-25-219-04Aug 5, 2025
Rockwell Automation
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Rockwell Automation Arena contains multiple memory safety vulnerabilities (CWE-125, CWE-121, CWE-122) affecting versions 16.20.09 and earlier, as well as all versions of Arena Simulation Multiple. These vulnerabilities allow local attackers without prior authentication to disclose sensitive information or execute arbitrary code. Arena Simulation Multiple is end-of-life with no fix planned. Arena version 16.20.10 or later addresses the vulnerabilities in the main product line. No public exploitation has been reported, and these vulnerabilities are not remotely exploitable.

What this means
What could happen
An attacker with local access to a machine running Arena could read sensitive data or run arbitrary commands on the affected simulation software, potentially compromising design integrity or confidentiality of manufacturing models.
Who's at risk
Manufacturing and process engineering teams using Rockwell Automation Arena for simulation and design work. This affects simulation workstations used for process modeling, equipment design, and validation before deployment to actual production systems. Organizations with Arena Simulation Multiple (which has no fix available) should prioritize phased retirement or isolation of those systems.
How it could be exploited
An attacker must have local access to a computer running vulnerable Arena version (16.20.09 or earlier) or any version of Arena Simulation Multiple. The attacker could then exploit buffer overflow or out-of-bounds memory access vulnerabilities to disclose information or execute commands within the Arena application context.
Prerequisites
  • Local access to the computer running Arena
  • Ability to interact with the Arena application (no prior authentication required per CVSS)
  • Vulnerable Arena version installed (16.20.09 or earlier for Arena; all versions for Arena Simulation Multiple)
Local exploitation requiredLow complexity attackNo authentication required for exploitationNo fix planned for Arena Simulation Multiple (end-of-life)Buffer overflow and memory access vulnerabilitiesInformation disclosure and code execution possible
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (2)
1 with fix1 EOL
ProductAffected VersionsFix Status
Arena Simulation MultipleAll versionsNo fix (EOL)
Arena: <=16.20.09≤ 16.20.0916.20.10
Remediation & Mitigation
0/4
Do now
0/1
HARDENINGImplement physical and logical access controls to limit local access to computers running Arena to authorized personnel only
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Arena to version 16.20.10 or later
HARDENINGIsolate simulation workstations from the Internet and production networks; ensure they are not accessible from untrusted networks
Long-term hardening
0/1
Arena Simulation Multiple
WORKAROUNDDisable or remove Arena Simulation Multiple from systems where it is no longer needed; if required, implement strict local access controls and user restrictions
View full CISA ICS-CERT advisory
API: /api/v1/advisories/823baaf3-200f-429a-afb2-914c5853cd2e

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Rockwell Automation Arena | CVSS 7.8 - OTPulse