CVE-2025-9976 - Vulnerability Details - OpenCVE

An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Dassault	Station Launcher App

No data.

No data.

References

Link	Providers
https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976

History

Tue, 21 Oct 2025 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Dassault Dassault station Launcher App
Vendors & Products		Dassault Dassault station Launcher App

Tue, 14 Oct 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 13 Oct 2025 07:45:00 +0000

Type	Values Removed	Values Added
Description		An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.
Title		OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x
Weaknesses		CWE-78
References		https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2025-10-13T07:33:15.695Z

Updated: 2025-10-14T13:15:34.207Z

Reserved: 2025-09-04T11:28:40.897Z

Link: CVE-2025-9976

Vulnrichment

Updated: 2025-10-14T13:15:31.077Z

NVD

Status : Awaiting Analysis

Published: 2025-10-13T08:15:41.547

Modified: 2025-10-14T19:36:29.240

Link: CVE-2025-9976

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9976", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2025-09-04T11:28:40.897Z", "datePublished": "2025-10-13T07:33:15.695Z", "dateUpdated": "2025-10-14T13:15:34.207Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2025-10-13T07:33:15.695Z"}, "title": "OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "Station Launcher App in 3DEXPERIENCE platform", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2540", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2532", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2537", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2025x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2025x.FP.CFA.2532", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine."}]}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T13:15:28.135588Z", "id": "CVE-2025-9976", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:15:34.207Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9976", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T13:15:28.135588Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T13:15:31.077Z"}}], "cna": {"title": "OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "Station Launcher App in 3DEXPERIENCE platform", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2540"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2532"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2537"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2025x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2025x.FP.CFA.2532"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.", "supportingMedia": [{"type": "text/html", "value": "An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2025-10-13T07:33:15.695Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9976", "state": "PUBLISHED", "dateUpdated": "2025-10-14T13:15:34.207Z", "dateReserved": "2025-09-04T11:28:40.897Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2025-10-13T07:33:15.695Z", "assignerShortName": "3DS"}, "dataVersion": "5.1"}