CVE-2025-2287

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

• CWE-457
• CWE-824

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.htmlVendor Advisory

Published

Apr 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22864Rejected reason: Not used
• CVE-2025-22865Using ParsePKCS1PrivateKey to parse a RSA key that is missin…7.5
• CVE-2025-22866Due to the usage of a variable time instruction in the assem…4
• CVE-2025-22867On Darwin, building a Go module which contains CGO can trigg…7.5
• CVE-2025-22868An attacker can pass a malicious malformed token which cause…7.5
• CVE-2025-22869SSH servers which implement file transfer protocols are vuln…7.5
• CVE-2025-22870Matching of hosts against proxy patterns can improperly trea…4.4
• CVE-2025-22871The net/http package improperly accepts a bare LF as a line …9.1
• CVE-2025-22872The tokenizer incorrectly interprets tags with unquoted attr…6.5
• CVE-2025-22873It was possible to improperly access the parent directory of…3.8
• CVE-2025-22874Calling Verify with a VerifyOptions.KeyUsages that contains …7.5
• CVE-2025-2288A local code execution vulnerability exists in the Rockwell …7.8