Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-11158

An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable before it being initialized. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Published

2024-12-05T18:15:21.243

Last Modified

2025-04-18T18:15:37.060

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.7 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-665
  • Type: Primary
    CWE-665
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application rockwellautomation arena ≤ 16.20.00 Yes
References