EUVD-2025-20873Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | Complete system compromise — the attacker gains the ability to install malware, steal data, create backdoors, or pivot to other systems on the network. With a CVSS score of 7.8 (HIGH), this represents a significant risk. |
| Exploit ScenarioDerived | An attacker sends a specially crafted request to the vulnerable service that triggers code execution with the privileges of the running process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
Earlier versions of this analysis (1)
RemediationAI
Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Improper Input Validation (CWE-20).
Know when Arena gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Executive ViewAI
Organizations using A remote code execution security face notable risk from CVE-2025-6377, a input validation vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the siman
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the linke
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the expmt
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the model
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
GitHub PoC
Exploit-DB