CVE-2025-2285 - Local Code Execution Vulnerability in Arena®

Back Back to CVE browser

HIGH

Local Code Execution Vulnerability in Arena®

Published Apr 8, 2025

8.5

HIGH

CVSS 4.0

EPSS 0.30%

Description

A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Affected products

Vendor Rockwell Automation Product Arena® Default
unaffected
- Version
  16.20.08 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rockwell Automation

Arena®

unaffected

Version	Status	Constraints
16.20.08 and earlier	affected	-

Remediation

Vendor solution

Corrected in v.16.20.09.

Weaknesses (2)

CWE-457

CWE-824

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10280
Advisory
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10280		Advisory
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html		Vendor Advisory