Read the docs
TI-2019-10153 Aliases CVE-2019-13521GHSA-rr25-rmv3-92rm

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation…

Priority MEDIUM 43CWE-357Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.

Why it matters now

EPSS 0.05571 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RockwellRockwell Automation Arena Simulation Softwareup to 16.00.00—No fix listedCNA
  • Rockwell Automation Arena Simulation Software VendorRockwell Affected up to 16.00.00 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*up to 16.00.00VulnerableRockwell
  • cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:* Versions up to 16.00.00 Vulnerable ·Rockwell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13521
  2. 2026-10-03 Alias added: GHSA-rr25-rmv3-92rm

References

Advisory 2

  • TI-2019-10142 Use after free in Rockwell Automation Arena Simulation Software versions 16.00.00 and… CVSS 3.0HIGH 7.8
  • TI-2023-13840 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-13839 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-10151 Type confusion in Rockwell Automation Arena Simulation Software CVSS 3.1HIGH 7.8
  • TI-2023-13841 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2019-10159 In Rockwell Automation Arena Simulation Software Cat. CVSS 3.1HIGH 7.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences