CVE-2024-6068
Input Validation Vulnerability exists in Arena® Input Analyzer
- State
- Published
- Severity
- 7.0 High
- Published
- Nov 14, 2024
- Updated
- Nov 14, 2024
- Reserved
- Jun 17, 2024
Description
A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DFT file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | Rockwell |
| 3.1 | 7.3 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | Rockwell |
Weaknesses
- CWE-1284 Improper Validation of Specified Quantity in Input
Affected Products
| Product | Versions |
|---|---|
Arena Input AnalyzerRockwell Automation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.