CVE-2024-11157
highpriority · track · 29EPSS 0.002 · 14 %ileEURUUSEPSS · scored 2026-10-27
A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedArenacisa_csaf_ot
Do not load untrusted Arena model files.
- MitigationArenacisa_csaf_ot
Hold the control key down when loading files to help prevent the VBA file stream from loading.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-24-345-06Rockwell Automation Arena (Update C)2024-12-10icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in execution of arbitrary code.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.htmlcnnvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.htmlenisa_euvd
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.htmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan