CVE-2025-6204 - Vulnerability Details - OpenCVE

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
3ds	Delmia Apriso

No data.

No data.

References

Link	Providers
https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204

History

Tue, 05 Aug 2025 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		3ds 3ds delmia Apriso
Vendors & Products		3ds 3ds delmia Apriso

Mon, 04 Aug 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 04 Aug 2025 09:30:00 +0000

Type	Values Removed	Values Added
Description		An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
Title		Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Weaknesses		CWE-94
References		https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2025-08-04T09:14:08.343Z

Updated: 2025-08-04T15:50:49.434Z

Reserved: 2025-06-17T14:03:08.909Z

Link: CVE-2025-6204

Vulnrichment

Updated: 2025-08-04T15:50:45.253Z

NVD

Status : Awaiting Analysis

Published: 2025-08-04T10:15:27.800

Modified: 2025-08-04T15:06:15.833

Link: CVE-2025-6204

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-6204", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2025-06-17T14:03:08.909Z", "datePublished": "2025-08-04T09:14:08.343Z", "dateUpdated": "2025-08-04T15:50:49.434Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2025-08-04T09:14:08.343Z"}, "title": "Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Apriso", "versions": [{"status": "affected", "version": "Release 2020 Golden", "lessThanOrEqual": "Release 2020 SP4", "versionType": "custom"}, {"status": "affected", "version": "Release 2021 Golden", "lessThanOrEqual": "Release 2021 SP3", "versionType": "custom"}, {"status": "affected", "version": "Release 2022 Golden", "lessThanOrEqual": "Release 2022 SP3", "versionType": "custom"}, {"status": "affected", "version": "Release 2023 Golden", "lessThanOrEqual": "Release 2023 SP3", "versionType": "custom"}, {"status": "affected", "version": "Release 2024 Golden", "lessThanOrEqual": "Release 2024 SP1", "versionType": "custom"}, {"status": "affected", "version": "Release 2025 Golden", "lessThanOrEqual": "Release 2025 SP1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code."}]}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T15:49:53.504308Z", "id": "CVE-2025-6204", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T15:50:49.434Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6204", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-04T15:49:53.504308Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T15:50:45.253Z"}}], "cna": {"title": "Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Apriso", "versions": [{"status": "affected", "version": "Release 2020 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2020 SP4"}, {"status": "affected", "version": "Release 2021 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2021 SP3"}, {"status": "affected", "version": "Release 2022 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2022 SP3"}, {"status": "affected", "version": "Release 2023 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2023 SP3"}, {"status": "affected", "version": "Release 2024 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2024 SP1"}, {"status": "affected", "version": "Release 2025 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2025 SP1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.", "supportingMedia": [{"type": "text/html", "value": "An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2025-08-04T09:14:08.343Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6204", "state": "PUBLISHED", "dateUpdated": "2025-08-04T15:50:49.434Z", "dateReserved": "2025-06-17T14:03:08.909Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2025-08-04T09:14:08.343Z", "assignerShortName": "3DS"}, "dataVersion": "5.1"}