Rockwell Arena Out-Of-Bounds Write RCE Vulnerability (CVE-2025-8377/8378) Advisory

Key Information Vulnerability Overview Vulnerability Name: Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability Severity: High CVE ID: CVE-2025-8377, CVE-2025-8378 Announcement ID: SN7975 Release Date: July 9, 2025 Last Updated: July 9, 2025 Revision Version: 1.0 Known Exploited Vulnerabilities (KEV): No Fixed: Yes Workarounds: No Affected Products and Solutions Vulnerability Details CVE-2025-8377 Impact - A remote code execution security issue exists in the affected products. A specially crafted DOE file can force Arena Simulation to write beyond the bounds of an allocated object. Exploitation of this vulnerability requires user interaction, such as opening a malicious file within the software. If successfully exploited, threat actors could execute arbitrary code on the target system with administrative privileges, leading to severe consequences. - CVSS Score: 7.8 (ZDI), 7.0 (Rockwell) CVE-2025-8378 Impact - A remote code execution security issue exists in the affected products. A controlled UOF file can contain data that causes Arena Simulation to write beyond the bounds of an allocated object. Exploitation of this vulnerability requires user interaction, such as opening a malicious file within the software. If successfully exploited, threat actors could execute arbitrary code on the target system with administrative privileges, leading to severe consequences. - CVSS Score: 7.8 (ZDI), 7.0 (Rockwell) Mitigation and Workarounds Users should upgrade to the patched versions as soon as possible. If users cannot upgrade, they should implement security best practices. Customers can use site-specific vulnerability categorization to generate environment-specific prioritization.

Goal Reached Thanks to every supporter — we hit 100%!

Rockwell Arena Out-Of-Bounds Write RCE Vulnerability (CVE-2025-8377/8378) Advisory