ID
VAR-202403-2964
CVE
CVE-2024-21913
TITLE
Rockwell Automation of arena simulation Out-of-bounds write vulnerability in
Trust: 0.8
DESCRIPTION
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Rockwell Automation of arena simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Rockwell Automation Arena Simulation Software is a set of simulation software from Rockwell Automation of the United States that provides 3D animation and graphics functions
Trust: 2.16
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | rockwellautomation | model: | arena | scope: | lt | version: | 16.20.03 | Trust: 1.0 |
| vendor: | rockwellautomation | model: | arena | scope: | gte | version: | 16.00.00 | Trust: 1.0 |
| vendor: | rockwell automation | model: | arena simulation | scope: | eq | version: | 16.00.00 that's all 16.20.03 | Trust: 0.8 |
| vendor: | rockwell automation | model: | arena simulation | scope: | - | version: | - | Trust: 0.8 |
| vendor: | rockwell automation | model: | arena simulation | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | rockwell | model: | automation arena simulation software | scope: | eq | version: | 16.00 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-122 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Heap-based buffer overflow (CWE-122) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
PATCH
| title: | Patch for Rockwell Automation Arena Simulation Software Heap Buffer Overflow Vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/543371 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-21913 | Trust: 3.2 |
| db: | ICS CERT | id: | ICSA-24-086-03 | Trust: 0.8 |
| db: | JVN | id: | JVNVU95922371 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2024-014194 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-18332 | Trust: 0.6 |
REFERENCES
| url: | https://www.rockwellautomation.com/en-us/support/advisory.sd-1665.html | Trust: 1.6 |
| url: | https://jvn.jp/vu/jvnvu95922371/ | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-21913 | Trust: 0.8 |
| url: | https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-03 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2024-18332 |
| db: | JVNDB | id: | JVNDB-2024-014194 |
| db: | NVD | id: | CVE-2024-21913 |
LAST UPDATE DATE
2024-12-17T22:36:09.423000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-18332 | date: | 2024-04-17T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-014194 | date: | 2024-12-10T00:45:00 |
| db: | NVD | id: | CVE-2024-21913 | date: | 2024-12-17T16:16:24.157 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-18332 | date: | 2024-04-17T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-014194 | date: | 2024-12-10T00:00:00 |
| db: | NVD | id: | CVE-2024-21913 | date: | 2024-03-26T16:15:10.670 |