A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Arena | Rockwellautomation | * | 16.20.09 (excluding) |