CVE-2025-6204
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
Description
CVE-2025-6204 is a high-severity code injection vulnerability in Dassault Systemes DELMIA Apriso, carrying a CVSS v3.1 score of 8.0. The flaw allows an authenticated attacker with high privileges to execute arbitrary code on the DELMIA Apriso server, with the potential to affect resources beyond the vulnerable component due to the Changed Scope designation. Affected versions span from Release 2020 through Release 2025. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 18, 2025. The EPSS score of 0.0882 (92.4th percentile) indicates a high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| 3ds | delmia apriso | >= 2020, <= 2025 |
References
- https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6204(US Government Resource)
Weakness Type
CWE-94: Code Injection
CWE-94 describes a vulnerability where an application allows user-controlled input to be incorporated into dynamically generated code that is subsequently executed. In CVE-2025-6204, the DELMIA Apriso manufacturing execution system fails to properly sanitize input in a code evaluation context, allowing an attacker to inject and execute arbitrary code on the server. This is particularly dangerous in a manufacturing environment where the application controls production processes and has access to operational technology systems.
Impact Analysis
The business impact of CVE-2025-6204 is severe, particularly given the critical role DELMIA Apriso plays in manufacturing environments. DELMIA Apriso is a Manufacturing Execution System (MES) used to manage and control production operations in industries including automotive, aerospace, pharmaceuticals, and electronics. Confidentiality, integrity, and availability are all rated as high impact, and the Changed Scope designation means exploitation can affect systems beyond the Apriso application itself — potentially including production control systems, enterprise resource planning (ERP) integrations, and other connected operational technology.
The exploitation prerequisites provide some mitigation: the attack requires high privileges and high complexity, meaning an attacker needs an authenticated high-level account on the Apriso platform and must navigate complex conditions to achieve code execution. However, the EPSS score of 0.0882 (92.4th percentile) and KEV listing confirm that these barriers have been overcome in real-world attacks. In a manufacturing context, the consequences of code execution extend beyond data theft to include potential disruption of production lines, manipulation of quality control data, interference with supply chain processes, and in safety-critical industries, potential physical safety hazards. Ransomware association is listed as unknown, but manufacturing systems are high-value ransomware targets because production downtime creates immediate and significant financial pressure to pay.
Exploit Maturity
CVE-2025-6204 is confirmed as actively exploited in the wild. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 18, 2025. EPSS context: The score of 0.0882 (92.4th percentile) indicates high exploitation activity, well above the threshold that typically correlates with active campaigns.
No publicly available proof-of-concept exploit has been identified in the reference materials. The Dassault Systemes security advisory provides the official vendor guidance. The combination of high privileges required and high attack complexity suggests that exploitation may be conducted by sophisticated threat actors with specific interest in manufacturing environments rather than opportunistic attackers. Ransomware association: Currently listed as unknown, but the manufacturing sector has been heavily targeted by ransomware groups in recent years.
Remediation
-
Apply the vendor patch — Contact Dassault Systemes support to obtain and apply the security update for your specific DELMIA Apriso release version (2020 through 2025 are affected). Refer to the Dassault Systemes security advisory for patching guidance specific to your deployment.
-
Review and restrict high-privilege accounts — Since the vulnerability requires high-privilege access, audit all accounts with elevated permissions in DELMIA Apriso. Remove unnecessary privilege assignments, implement the principle of least privilege, and ensure multi-factor authentication is enabled for all administrative accounts.
-
Segment the DELMIA Apriso network — Isolate the Apriso application server from general enterprise network traffic using network segmentation. Place the MES system in a dedicated network zone with strict firewall rules that only permit necessary communications with production systems, databases, and authorized administrator workstations.
-
Implement application-level monitoring — Deploy logging and monitoring for DELMIA Apriso that captures authentication events, privilege usage, and any anomalous code execution patterns. Alert on unusual administrative actions, particularly those involving code evaluation or scripting interfaces.
-
Coordinate with OT security — Since DELMIA Apriso bridges IT and operational technology environments, coordinate the patching and mitigation effort with your OT security team to ensure that patching does not disrupt production operations and that OT-side monitoring is in place to detect any lateral movement from a compromised Apriso instance.
Technical Details
The CVSS v3.1 vector for CVE-2025-6204 is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, resulting in a high score of 8.0. Attack Vector (Network) confirms remote exploitation is possible over the network. Attack Complexity (High) indicates that exploitation requires specific conditions or sophisticated techniques beyond simply sending a malicious request. Privileges Required (High) means the attacker needs an administrative or highly privileged account in DELMIA Apriso. The critical Scope (Changed) metric indicates that exploiting this vulnerability in Apriso can impact other connected systems.
The vulnerability is a code injection flaw in DELMIA Apriso's application logic, where certain input fields or API parameters that accept user-supplied data are processed through a code evaluation mechanism. When a high-privilege user provides specially crafted input containing executable code constructs, the application interprets and executes this code on the server rather than treating it as data. The high attack complexity likely reflects the need to identify the specific vulnerable code evaluation point, craft payloads that conform to the application's expected input format while still achieving code execution, and potentially chain multiple steps to reach the vulnerable functionality. DELMIA Apriso's role as a Manufacturing Execution System means it typically has deep integrations with production databases, enterprise systems (SAP, Oracle), and potentially industrial control systems, which explains the Changed Scope designation — code execution on the Apriso server can cascade to affect these connected systems. The vulnerability's impact across all releases from 2020 through 2025 suggests a fundamental architectural issue in how the application handles code evaluation rather than a recently introduced bug.
Frequently Asked Questions
What is CVE-2025-6204?
CVE-2025-6204 is a code injection vulnerability in Dassault Systemes DELMIA Apriso, a Manufacturing Execution System (MES) used to manage production operations. An authenticated attacker with high-level privileges can exploit this flaw to execute arbitrary code on the server, potentially affecting connected production systems.
What is DELMIA Apriso and why does this matter?
DELMIA Apriso is a manufacturing execution system used in industries including automotive, aerospace, pharmaceuticals, and electronics to manage and control production operations. A code execution vulnerability in this system could potentially disrupt production lines, compromise quality control data, and affect connected operational technology systems.
What access does an attacker need to exploit this?
The vulnerability requires network access to the DELMIA Apriso application, a high-privilege user account, and the ability to navigate high-complexity exploitation conditions. While these prerequisites limit casual exploitation, CISA's KEV listing confirms that sophisticated threat actors have successfully exploited this vulnerability in real-world attacks.
Is CVE-2025-6204 related to CVE-2025-6205?
Both CVE-2025-6204 and CVE-2025-6205 affect DELMIA Apriso across the same version range (Release 2020 through 2025), but they are distinct vulnerabilities. CVE-2025-6204 is a code injection flaw requiring high privileges, while CVE-2025-6205 is a missing authorization vulnerability exploitable without authentication. Organizations should patch both vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.