# Rockwell Arena Simulation RCE: CVE-2024-37367 and CVE-2024-37368 Patch

> Rockwell Automation addresses high-severity memory corruption flaws in Arena simulation software that enable remote code execution via malicious .doe files.

- Published: 2026-07-25T09:49:59.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Rockwell Automation, Arena Simulation, CVE-2024-37367, CVE-2024-37368, ICS Security, RCE
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/rockwell-patches-code-execution-flaws-in-arena-simulation-software/
- Canonical: https://runtimerebel.com/blog/rockwell-arena-simulation-rce-cve-2024-37367-and-cve-2024-37368-patch

## Key points

- Attackers can execute arbitrary code on systems running vulnerable Arena software by tricking users into opening malicious simulation files.
- Arena simulation software version 16.20.04 and all prior releases are susceptible to these memory corruption vulnerabilities.
- Organizations should immediately update to Arena version 16.20.05 or newer to mitigate the risk of exploitation.

Rockwell Automation has released security updates to address two high-severity vulnerabilities in its Arena simulation software that could lead to [RCE](/glossary#rce) if a user is coerced into opening a specially crafted file. These flaws, identified as [CVE-2024-37367](https://nvd.nist.gov/vuln/detail/CVE-2024-37367) and [CVE-2024-37368](https://nvd.nist.gov/vuln/detail/CVE-2024-37368), were discovered and reported by security researcher Michael Heinzl, according to [SecurityWeek](https://www.securityweek.com/rockwell-patches-code-execution-flaws-in-arena-simulation-software/).

## Vulnerability Overview: Rockwell Arena Memory Corruption

The vulnerabilities reside in the way Arena handles simulation files, specifically those with the .doe extension. Technical analysis indicates that the flaws are rooted in memory corruption issues. CVE-2024-37367 is an out-of-bounds write vulnerability, while CVE-2024-37368 is an out-of-bounds read. Both vulnerabilities carry a [CVSS](/glossary#cvss) v3 base score of 7.8, reflecting their high potential for impact on system integrity and confidentiality.

Arena is a discrete event simulation software widely used in industrial environments to model complex processes in manufacturing, logistics, and healthcare. Because simulation files are frequently shared between engineers and stakeholders for process optimization, they represent a significant [Phishing](/glossary#phishing) or social engineering vector. If an attacker successfully tricks a user into opening a malicious .doe file, they can exploit these memory corruption flaws to execute arbitrary code within the context of the current user. This could lead to a full system compromise, providing a foothold for [Lateral Movement](/glossary#lateral-movement) within a corporate or industrial network.

### Rockwell Arena version 16.20.04 patch guidance and Detection

Defenders should prioritize identifying all installations of the affected software. Rockwell Automation confirmed that Arena version 16.20.04 and all earlier versions are vulnerable. The primary remediation strategy is to upgrade to Arena version 16.20.05, which contains the necessary logic to safely parse simulation files and prevent memory corruption. For organizations unable to patch immediately, implementing strict file-handling policies is necessary. Users should be instructed not to open simulation files from untrusted or external sources.

From a monitoring perspective, the [SOC](/glossary#soc) should look for indicators of exploitation. Those researching how to detect CVE-2024-37367 exploit attempts should focus on monitoring the Arena.exe process for unusual child process creation or unexpected network connections following the opening of a .doe file. Using an [EDR](/glossary#edr) to track memory-based [TTP](/glossary#ttp)s can help identify the initial stages of a memory corruption exploit. While no public exploits are currently reported in the wild, the technical nature of these flaws makes the development of a PoC feasible for sophisticated actors.

## Impact on Industrial Organizations

The targeting of simulation software is a calculated move for an [APT](/glossary#apt). In many industrial sectors, simulation software is used to design "Digital Twins" of physical production lines. Compromising these systems not only allows for data theft but also enables an attacker to understand the intricate workings of a facility's operations. This intelligence can be used to plan more disruptive physical attacks or to inject subtle errors into production models, leading to long-term operational degradation. Mitigating memory corruption in industrial simulation software is therefore a critical component of maintaining the overall security posture of the industrial control system (ICS) environment.

Defenders should map these threats against the [MITRE ATT&CK](/glossary#mitre-att-ck) framework, specifically focusing on 'User Execution: Malicious File' (T1204.002). By incorporating these [CVE](/glossary#cve) IDs into vulnerability management workflows and ensuring that simulation workstations are isolated from critical production networks, organizations can significantly reduce the risk of a successful breach.

**Related:** [Iranian Hackers Target Siemens, Schneider, Rockwell ICS PLCs](/blog/iranian-hackers-target-siemens-schneider-rockwell-ics-plcs), [Siemens and Schneider Patch Critical ICS Flaws — October 2024](/blog/siemens-and-schneider-patch-critical-ics-flaws-october-2024)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/rockwell-arena-simulation-rce-cve-2024-37367-and-cve-2024-37368-patch