CVE-2024-21912: 
NixOS vulnerability analysis and mitigation

An arbitrary code execution vulnerability (CVE-2024-21912) was discovered in Rockwell Automation Arena Simulation software. The vulnerability affects versions from 16.00.00 up to (excluding) 16.20.03. This security flaw was reported on March 26, 2024, and involves writing beyond designated memory areas, which can lead to unauthorized code execution (NVD, CISA).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with a CVSS v3.1 base score of 7.8 (HIGH) and vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, it has received a CVSS v4.0 score of 8.4 with vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (CISA).

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized code on the system, affecting the confidentiality, integrity, and availability of the product. The attack requires user interaction, specifically opening a malicious file shared by the threat actor (NVD, CISA).

The vulnerability requires local access and user interaction to exploit. The attacker needs to convince a user to open a malicious file. No known public exploitation specifically targeting this vulnerability has been reported, and it is not exploitable remotely (CISA).

Rockwell Automation recommends upgrading the affected product software to version 16.20.03. Users are advised not to open untrusted files from unknown sources. The company encourages implementation of suggested security best practices to minimize the vulnerability risk (CISA).