PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-12672 Rockwell Automation CVE debrief

A third-party vulnerability in Rockwell Automation Arena 32-bit (versions ≤16.20.07) allows memory corruption via malformed DOE files, enabling arbitrary code execution under local user interaction. The vulnerability was disclosed by CISA on December 10, 2024, with an advisory update (Update B) published February 3, 2026. Rockwell Automation has released version 16.20.09 to address this issue.

Vendor
Rockwell Automation
Product
Arena
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2026-06-23
Advisory published
2024-12-10
Advisory updated
2026-06-23

Who should care

Organizations using Rockwell Automation Arena 32-bit for discrete event simulation in manufacturing, logistics, and process design; industrial control system operators; OT security teams; and asset owners following CISA ICS advisories.

Technical summary

CVE-2024-12672 is an out-of-bounds write vulnerability in Rockwell Automation Arena 32-bit simulation software, affecting versions 16.20.07 and earlier. The flaw exists in DOE (Design of Experiments) file parsing, where insufficient bounds checking allows writing beyond allocated memory boundaries. Exploitation requires a legitimate user to open a maliciously crafted DOE file, resulting in arbitrary code execution in the context of the current user. The attack vector is local (AV:L) with low attack complexity (AC:L) and requires user interaction (UI:R). This vulnerability was addressed in Arena version 16.20.09.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Rockwell Automation Arena 32-bit to version 16.20.09 or later
  • Hold the Control key when loading files to prevent VBA file stream from loading
  • Implement Rockwell Automation security best practices for industrial control systems
  • Apply Stakeholder-Specific Vulnerability Categorization (SSVC) for environment-specific prioritization
  • Review CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

CISA advisory ICSA-24-345-06 (Update B) documents this as a third-party vulnerability in Arena's DOE file parsing. CVSS 3.1 score of 7.8 reflects local attack vector with user interaction required. The advisory was initially published December 10, 2024, with Update A on January 9, 2025 adding this CVE, and Update B on February 3, 2026 adding additional CVEs and updated mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-12672 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-12672

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-12672 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-12672

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-345-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.