CVE-2025-5086 - Vulnerability Details - OpenCVE

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.3ds.com/vulnerability/advisories

History

Wed, 04 Jun 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 03 Jun 2025 06:30:00 +0000

Type	Values Removed	Values Added
Description	A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Â could lead to a remote code execution.	A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Metrics	cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

Mon, 02 Jun 2025 18:00:00 +0000

Type	Values Removed	Values Added
Description		A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Â could lead to a remote code execution.
Title		Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Weaknesses		CWE-502
References		https://www.3ds.com/vulnerability/advisories
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2025-06-02T17:42:42.620Z

Updated: 2025-06-04T20:18:04.955Z

Reserved: 2025-05-22T11:43:30.702Z

Link: CVE-2025-5086

Vulnrichment

Updated: 2025-06-04T20:18:00.570Z

NVD

Status : Awaiting Analysis

Published: 2025-06-02T18:15:25.010

Modified: 2025-06-04T14:54:53.980

Link: CVE-2025-5086

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-5086", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2025-05-22T11:43:30.702Z", "datePublished": "2025-06-02T17:42:42.620Z", "dateUpdated": "2025-06-04T20:18:04.955Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2025-06-03T06:13:48.084Z"}, "title": "Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Apriso", "versions": [{"status": "affected", "version": "Release 2020 Golden", "lessThanOrEqual": "Release 2020 SP4", "versionType": "custom"}, {"status": "affected", "version": "Release 2021 Golden", "lessThanOrEqual": "Release 2021 SP3", "versionType": "custom"}, {"status": "affected", "version": "Release 2022 Golden", "lessThanOrEqual": "Release 2022 SP3", "versionType": "custom"}, {"status": "affected", "version": "Release 2023 Golden", "lessThanOrEqual": "Release 2023 SP3", "versionType": "custom"}, {"status": "affected", "version": "Release 2024 Golden", "lessThanOrEqual": "Release 2024 SP1", "versionType": "custom"}, {"status": "affected", "version": "Release 2025 Golden", "lessThanOrEqual": "Release 2025 SP1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution."}]}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Hacktron AI", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-04T20:17:50.401576Z", "id": "CVE-2025-5086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T20:18:04.955Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-04T20:17:50.401576Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T20:18:00.570Z"}}], "cna": {"title": "Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Hacktron AI"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Apriso", "versions": [{"status": "affected", "version": "Release 2020 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2020 SP4"}, {"status": "affected", "version": "Release 2021 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2021 SP3"}, {"status": "affected", "version": "Release 2022 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2022 SP3"}, {"status": "affected", "version": "Release 2023 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2023 SP3"}, {"status": "affected", "version": "Release 2024 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2024 SP1"}, {"status": "affected", "version": "Release 2025 Golden", "versionType": "custom", "lessThanOrEqual": "Release 2025 SP1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.", "supportingMedia": [{"type": "text/html", "value": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2025-06-03T06:13:48.084Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5086", "state": "PUBLISHED", "dateUpdated": "2025-06-04T20:18:04.955Z", "dateReserved": "2025-05-22T11:43:30.702Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2025-06-02T17:42:42.620Z", "assignerShortName": "3DS"}, "dataVersion": "5.1"}