Information disclosure in Rockwell Automation Arena Simulation Software versions 16.00.00…
Priority LOW 25CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation.
Why it matters now
EPSS 0.05777 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier | — | No fix listed | CNA |
- Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier Vendor— Affected Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13511
- 2026-10-03 Alias added: GHSA-6p7p-7664-cqrj
References
Advisory 6
- https://www.us-cert.gov/ics/advisories/icsa-19-213-05
- https://www.zerodayinitiative.com/advisories/ZDI-20-814/
- https://www.zerodayinitiative.com/advisories/ZDI-20-810/
- https://www.zerodayinitiative.com/advisories/ZDI-20-811/
- https://www.zerodayinitiative.com/advisories/ZDI-20-813/
- https://www.zerodayinitiative.com/advisories/ZDI-20-812/
More Rockwell Arena vulnerabilities
- TI-2019-10142 Use after free in Rockwell Automation Arena Simulation Software versions 16.00.00 and… CVSS 3.0HIGH 7.8
- TI-2023-13840 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-13839 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2019-10153 A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation… CVSS 3.1HIGH 7.8
- TI-2019-10151 Type confusion in Rockwell Automation Arena Simulation Software CVSS 3.1HIGH 7.8
- TI-2023-13841 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2019-13511 · CVE Program
- CVE-2019-13511 · NVD
- FIRST EPSS
- GHSA-6p7p-7664-cqrj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences