CVE-2019-13521

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-357

Affected software

Vendor	Product	Versions
Rockwell	Rockwell Automation Arena Simulation Software	Versions 16.00.00 and earlier

References

https://www.us-cert.gov/ics/advisories/icsa-19-213-05Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-799/Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-213-05Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-799/Third Party Advisory, VDB Entry

Timeline

Published: Jan 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-135227.8An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Vers CVE-2019-135235.3In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to CVE-2019-135247.5GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End CVE-2019-135255.3In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to CVE-2019-135268.8Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to CVE-2019-135277.8In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an CVE-2019-135284.4A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-800 CVE-2019-135298.8An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissio CVE-2019-13539.8An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When CVE-2019-135307.2Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501,CVE-2019-135314.6In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platf CVE-2019-135327.5CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow