{ "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", "CVE_data_meta": { "ID": "CVE-2025-2285", "ASSIGNER": "PSIRT@rockwellautomation.com", "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", "value": "A local code execution vulnerability exists in the Rockwell Automation\u00a0Arena\u00ae \u00a0due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-457 Uninitialized Variable", "cweId": "CWE-457" } ] } ] }, "affects": { "vendor": { "vendor_data": [ { "vendor_name": "Rockwell Automation", "product": { "product_data": [ { "product_name": "Arena\u00ae", "version": { "version_data": [ { "version_affected": "=", "version_value": "16.20.08 and earlier" } ] } } ] } } ] } }, "references": { "reference_data": [ { "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html", "refsource": "MISC", "name": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html" } ] }, "generator": { "engine": "Vulnogram 0.2.0" }, "source": { "advisory": "SD1726", "discovery": "EXTERNAL" }, "solution": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Corrected in v.16.20.09." } ], "value": "Corrected in v.16.20.09." } ] }