CVE-2025-6204

Published Aug 4, 2025

Last updated 5 days ago

DELMIA Apriso

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6204 is a code injection vulnerability affecting Dassault Systèmes DELMIA Apriso, specifically versions from Release 2020 through Release 2025. This vulnerability could allow an attacker to execute arbitrary code. This vulnerability exists because of an improper control of code generation within the affected software. It has been added to CISA's Known Exploited Vulnerabilities (KEV) list, indicating it has been exploited in the wild.

Description: An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
Source: 3DS.Information-Security@3ds.com
NVD status: Analyzed
Products: delmia_apriso

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8
Impact score: 6
Exploitability score: 1.3
Vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
Exploit added on: Oct 28, 2025
Exploit action due: Nov 18, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

3DS.Information-Security@3ds.com: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "809F8ACE-5686-4178-ACF7-D6968035FCF5",
            "versionEndIncluding": "2025",
            "versionStartIncluding": "2020"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.