Rockwell Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability

An attacker could execute arbitrary code on systems running Arena Simulation, potentially allowing them to manipulate simulation parameters, inject false data into process models, or compromise the integrity of control system design and testing environments.

This affects any organization using Rockwell Arena Simulation for control system modeling, simulation, and design validation. This includes utilities, manufacturers, and engineering firms that use Arena to test PLC logic, process flows, and automation sequences before deployment to live systems.

An attacker with network access to Arena Simulation could send a specially crafted request that triggers an out-of-bounds write condition in memory. By writing to memory outside the intended buffer, the attacker could overwrite executable code and achieve remote code execution on the system running Arena Simulation.