8.0Yüksek
KEV
CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Aktif olarak istismar ediliyor — Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 28.10.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 18.11.2025.
Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6204
Açıklama
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
Zayıflık türü (CWE):
CWE-94
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| 3ds | delmia apriso | 2020 – ≤ 2025 | |
| Dassault Systèmes | DELMIA Apriso | Release 2020 Golden – ≤ Release 2020 SP4, Release 2021 Golden – ≤ Release 2021 SP3, Release 2022 Golden – ≤ Release 2022 SP3, Release 2023 Golden – ≤ Release 2023 SP3, Release 2024 Golden – ≤ Release 2024 SP1, Release 2025 Golden – ≤ Release 2025 SP1 |
Kaynaklar ve yamalar
- https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6204 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*≥ 2020 ≤ 2025