Rockwell Arena Simulation memory corruption flaws patched

Four out-of-bounds write vulnerabilities in Rockwell Automation Arena Simulation could let attackers execute arbitrary code via malicious files; no exploitation seen in the wild.

CISA published an advisory detailing four memory corruption vulnerabilities affecting Rockwell Automation Arena Simulation software, version V17.00.00 and earlier. The flaws reside in four separate executable components—model.exe, expmt.exe, linker.exe, and siman.exe (all part of the Siman engine)—and stem from improper validation of user-supplied data leading to out-of-bounds writes (CWE-787). Successful exploitation requires convincing a user to open a specially crafted malicious file, at which point an attacker could execute arbitrary code in the context of the current process.

Arena Simulation is used for industrial process modeling within the Critical Manufacturing sector, and Rockwell products are deployed worldwide. Rockwell Automation has released version V17.00.01 to remediate all four vulnerabilities, and CISA recommends organizations update promptly along with standard ICS network segmentation and phishing-awareness practices. The vulnerabilities were responsibly disclosed by researcher Michael Heinzl, and CISA states there is no known public exploitation targeting these issues at this time.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01