# Rockwell Automation Arena RCE via malicious DOE files

Published: 2026-02-03 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/2bc5117e-3677-589e-ad26-5ee9d978ec72/rockwell-automation-arena-rce-via-malicious-doe-files

> Nine code execution flaws in Rockwell Automation Arena up to v16.20.08 require user interaction to load malicious model files.

Rockwell Automation released an Update B advisory for Arena, an industrial automation simulation and design software, addressing nine vulnerabilities that allow arbitrary code execution. All vulnerabilities require a user to load a crafted DOE (Design of Experiment) model file to trigger exploitation, meaning no remote attack is possible without user interaction. The flaws span memory safety issues including use-after-free, out-of-bounds read/write, and uninitialized variable access across multiple Arena versions. Affected versions range from Arena v16.20.00 through v16.20.08 (with some affecting earlier patch levels), and both 32-bit and 64-bit builds are impacted. The vendor recommends immediate upgrade to v16.20.09 or later. Interim mitigations include avoiding untrusted model files and holding the control key during file load to prevent VBA stream processing. CISA reports no known public exploitation of these vulnerabilities at this time.

## Mentioned in this report

- Vulnerabilities: CVE-2024-11155, CVE-2024-11156, CVE-2024-11157, CVE-2024-11158, CVE-2024-11364, CVE-2024-12130, CVE-2024-12175, CVE-2024-12672, CVE-2025-6376, CVE-2025-6377

## Detection guidance (public sample)

### Rockwell Arena Spawning Shell or Script Interpreter

ATT&CK: T1204.002

Arena.exe spawning a command shell, script host or LOLBin, consistent with code execution after a crafted DOE model file is loaded. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Rockwell Arena Spawning Shell or Script Interpreter
description: Detects Rockwell Arena simulation software spawning command interpreters
  or common download/execution LOLBins. Arena does not normally launch these, so this
  is consistent with memory-corruption exploitation via a malicious DOE file or abuse
  of embedded VBA.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Arena.exe
    - \Arena64.exe
    - \Arena32.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \curl.exe
  condition: selection
falsepositives:
- Custom Arena models or VBA integrations that intentionally shell out to cmd.exe
  for data export or automation
level: high
id: 47c2569d-0afd-5f8e-bbb3-cd5594ff9f41
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06
```

### Rockwell Arena Opening DOE File From User-Writable or Mail/Download Location

ATT&CK: T1204.002

Arena launched with a .doe model file from Downloads, Temp or mail/browser cache paths, a likely user-execution step for a malicious DOE file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Rockwell Arena Opening DOE File From User-Writable or Mail/Download Location
description: Detects Arena being started with a .doe model file located in download,
  temp, or email attachment cache directories. Crafted DOE files must be loaded by
  the user to trigger the Arena RCE flaws, so untrusted-origin model loads are a useful
  triage signal.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \Arena.exe
    - \Arena64.exe
    - \Arena32.exe
  selection_file:
    CommandLine|contains: .doe
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Content.Outlook\
    - \INetCache\
    - \Temporary Internet Files\
  condition: selection_img and selection_file and selection_path
falsepositives:
- Engineers legitimately opening vendor- or colleague-supplied DOE models that were
  just downloaded
- Users opening model attachments directly from email
level: medium
id: 7bbc9e84-1c73-5cf5-be14-484966d6b995
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06
```

### DOE Model File Delivered by Email Client or Browser

ATT&CK: T1566

A .doe file written to disk by an email client or browser, a possible delivery vector for malicious Arena models. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DOE Model File Delivered by Email Client or Browser
description: Detects creation of .doe (Arena Design of Experiment) files by mail clients
  or web browsers. Delivery by phishing attachment or download is the realistic route
  to exploit the Arena vulnerabilities, which need a user to load the file. Most useful
  on hosts that do not normally handle Arena models.
tags:
- attack.initial-access
- attack.t1566
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \outlook.exe
    - \thunderbird.exe
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    TargetFilename|endswith: .doe
  condition: selection
falsepositives:
- Simulation engineers who exchange Arena models by email or download them from vendor
  portals
level: low
id: e2f1f853-a397-5004-a7d3-767cb24a2783
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2bc5117e-3677-589e-ad26-5ee9d978ec72/rockwell-automation-arena-rce-via-malicious-doe-files.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup