Sign-up

ID

VAR-202403-2758


CVE

CVE-2024-21919


TITLE

Rockwell Automation Arena Simulation Software Uninitialized Pointer Access Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-18334

DESCRIPTION

An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor

Trust: 1.44

sources: NVD: CVE-2024-21919 // CNVD: CNVD-2024-18334

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-18334

AFFECTED PRODUCTS

vendor:rockwellmodel:automation arena simulation softwarescope:eqversion:16.00

Trust: 0.6

sources: CNVD: CNVD-2024-18334

CVSS

SEVERITY

CVSSV2

CVSSV3

PSIRT@rockwellautomation.com: CVE-2024-21919
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-18334
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-18334
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

PSIRT@rockwellautomation.com: CVE-2024-21919
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-18334 // NVD: CVE-2024-21919

PROBLEMTYPE DATA

problemtype:CWE-824

Trust: 1.0

sources: NVD: CVE-2024-21919

PATCH

title:Patch for Rockwell Automation Arena Simulation Software Uninitialized Pointer Access Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/543381

Trust: 0.6

sources: CNVD: CNVD-2024-18334

EXTERNAL IDS

db:NVDid:CVE-2024-21919

Trust: 1.6

db:CNVDid:CNVD-2024-18334

Trust: 0.6

sources: CNVD: CNVD-2024-18334 // NVD: CVE-2024-21919

REFERENCES

url:https://www.rockwellautomation.com/en-us/support/advisory.sd-1665.html

Trust: 1.6

sources: CNVD: CNVD-2024-18334 // NVD: CVE-2024-21919

SOURCES

db:CNVDid:CNVD-2024-18334
db:NVDid:CVE-2024-21919

LAST UPDATE DATE

2024-08-14T15:36:29.196000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-18334date:2024-04-17T00:00:00
db:NVDid:CVE-2024-21919date:2024-03-26T17:09:53.043

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-18334date:2024-04-17T00:00:00
db:NVDid:CVE-2024-21919date:2024-03-26T16:15:11.073