CVE-2023-27858 - CVE House
Back to Database
Status published High CVE-2023-27858

Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability

Vulnerability Description

Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-27858

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • These vulnerabilities were reported to Rockwell Automation by Michael Heinzl

References

More from Rockwell Automation

View All →
CVE-2025-9466
ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities
High 8.7
CVE-2025-9465
ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities
High 8.7
CVE-2025-9464
Rockwell Automation ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities
High 8.7
CVE-2025-9437
Rockwell Automation ArmorStart® AOP Denial-of-Service Vulnerability
High 8.7
CVE-2025-9368
432ES-IG3 Series A Denial-of-Service Vulnerability
High 8.7

Affected Vendor

Rockwell Automation

View all reports →

Affected Software

Arena Simulation
Vulnerable Versions:
All versions before the 16.20.02 Patch

Timeline

Official Publish: October 27th, 2023
Last Modified: September 9th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-824

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation