« Volver al listado

CVE-2025-6205

Estado: AnalizadaCrítica (9.1)⚠ Explotación activa

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N sin autenticación (CWE-862) permite exploit remoto directo. Acceso privilegiado implica creación/modificación de cuentas autorizadas en aplicación expuesta.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUser Account ManagementNetwork SegmentationMulti-factor AuthenticationApplication Developer GuidanceActive Directory Configuration

Tecnologías afectadas (1)

3DS — Delmia Apriso

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6205",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6205",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-28T03:56:05.200345Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "3DS.Information-Security@3ds.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "3DS.Information-Security@3ds.com",
      "affectedData": [
        {
          "vendor": "Dassault Systèmes",
          "product": "DELMIA Apriso",
          "versions": [
            {
              "status": "affected",
              "version": "Release 2020 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "Release 2020 SP4"
            },
            {
              "status": "affected",
              "version": "Release 2021 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "Release 2021 SP3"
            },
            {
              "status": "affected",
              "version": "Release 2022 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "Release 2022 SP3"
            },
            {
              "status": "affected",
              "version": "Release 2023 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "Release 2023 SP3"
            },
            {
              "status": "affected",
              "version": "Release 2024 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "Release 2024 SP1"
            },
            {
              "status": "affected",
              "version": "Release 2025 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "Release 2025 SP1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-04T10:15:28.057",
  "references": [
    {
      "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "3DS.Information-Security@3ds.com"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6205",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3DS.Information-Security@3ds.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autorización faltante que afecta a DELMIA Apriso desde la versión 2020 hasta la versión 2025 podría permitir que un atacante obtenga acceso privilegiado a la aplicación."
    }
  ],
  "lastModified": "2026-06-17T10:01:22.973",
  "cisaActionDue": "2025-11-18",
  "cisaExploitAdd": "2025-10-28",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83419377-1A54-43D7-B7EC-064555B91D12",
              "versionEndExcluding": "2025",
              "versionStartIncluding": "2020"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "3DS.Information-Security@3ds.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability"
}