CVE-2025-6205
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
Description
CVE-2025-6205 is a critical missing authorization vulnerability in Dassault Systemes DELMIA Apriso with a CVSS v3.1 score of 9.1. The flaw allows an unauthenticated remote attacker to gain privileged access to the DELMIA Apriso application without any credentials, affecting releases from 2020 through 2025. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 18, 2025. The EPSS score of 0.49541 (97.7th percentile) indicates an extremely high probability of active exploitation, making this one of the most critical vulnerabilities affecting manufacturing execution systems.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| 3ds | delmia apriso | >= 2020, < 2025 |
References
- https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6205(US Government Resource)
Weakness Type
CWE-862: Missing Authorization
CWE-862 describes a vulnerability where an application fails to perform an authorization check when a user attempts to access a resource or perform an action that requires verified permissions. In CVE-2025-6205, the DELMIA Apriso application exposes functionality or endpoints that should require authentication and authorization but fails to enforce any access controls, allowing unauthenticated external attackers to directly access privileged application features.
Impact Analysis
The business impact of CVE-2025-6205 is critical, particularly due to the combination of unauthenticated access and the sensitive nature of DELMIA Apriso as a manufacturing execution system. Confidentiality is rated as high impact because an attacker who gains privileged access can read production data, process configurations, quality control records, employee information, and potentially trade secrets embedded in manufacturing processes. Integrity is also rated as high because privileged access enables modification of production parameters, quality control data, manufacturing instructions, and user accounts.
The threat context is extremely concerning. Unlike CVE-2025-6204, which requires high-privilege authentication, CVE-2025-6205 requires no authentication whatsoever, making it far more dangerous and easier to exploit at scale. The EPSS score of 0.49541 (97.7th percentile) confirms very high exploitation activity. Any internet-facing or internally accessible DELMIA Apriso instance running an affected version is at immediate risk. In manufacturing environments, the consequences extend beyond traditional IT concerns: unauthorized modification of production parameters could lead to defective products, supply chain disruption, regulatory compliance violations (particularly in pharmaceutical and aerospace manufacturing), and potential safety hazards. Ransomware association is listed as unknown, but the ability to gain privileged access to a critical manufacturing system without any credentials makes this an ideal initial access vector for ransomware operators targeting industrial organizations.
Exploit Maturity
CVE-2025-6205 is confirmed as actively exploited in the wild. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 18, 2025. EPSS context: The score of 0.49541 (97.7th percentile) places this among the most actively exploited vulnerabilities in the current landscape, indicating widespread and sustained exploitation campaigns.
No publicly available proof-of-concept exploit has been identified in the reference materials, though the high EPSS score suggests exploitation tools are circulating in threat actor communities. The Dassault Systemes security advisory provides the official vendor guidance. The missing authorization nature of the vulnerability means exploitation is likely straightforward — accessing unprotected endpoints without credentials is inherently simpler than more complex attack vectors. Ransomware association: Currently listed as unknown, but manufacturing environments are prime ransomware targets due to the high cost of production downtime.
Remediation
-
Apply the vendor patch immediately — Contact Dassault Systemes support to obtain and apply the security update for your DELMIA Apriso installation. Refer to the Dassault Systemes security advisory for version-specific patching instructions covering Release 2020 through 2025.
-
Restrict network access urgently — Since this vulnerability requires no authentication, network-level controls are the most effective interim mitigation. Immediately restrict access to the DELMIA Apriso application server to only authorized IP addresses using firewall rules. Ensure the application is not accessible from the internet.
-
Deploy a Web Application Firewall — Implement WAF rules in front of the DELMIA Apriso application that enforce authentication for all endpoints. This provides defense-in-depth while the vendor patch is being applied and tested.
-
Audit for unauthorized access — Review DELMIA Apriso access logs for any signs of unauthorized access, particularly requests to privileged endpoints that did not include valid authentication credentials. Check for unauthorized data modifications, new user accounts, or changes to production configurations.
-
Implement defense-in-depth for MES systems — Beyond patching, implement additional security layers around the DELMIA Apriso deployment: network segmentation isolating the MES from general network traffic, intrusion detection systems monitoring for anomalous access patterns, and regular security assessments of the MES environment to identify future vulnerabilities before they are exploited.
Technical Details
The CVSS v3.1 vector for CVE-2025-6205 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, producing a critical score of 9.1. Attack Vector (Network) confirms remote exploitation over the network. Attack Complexity (Low) means exploitation is straightforward and reliable. Privileges Required (None) is the critical differentiator — no authentication whatsoever is needed. User Interaction (None) means the attack is fully automated.
The vulnerability is a missing authorization flaw in DELMIA Apriso where certain application endpoints or API functions that provide privileged access to the MES platform fail to verify whether the requesting user is authenticated and authorized. This means an attacker can directly send requests to these endpoints and receive responses containing privileged data or successfully invoke privileged operations without ever providing credentials. The missing authorization likely affects specific API endpoints or application routes that were intended to be protected by an authentication middleware or access control layer that is either absent or improperly configured. The Availability (None) impact rating suggests the vulnerability primarily enables unauthorized data access and modification rather than service disruption, though an attacker with privileged access could certainly cause operational disruption through data manipulation. The affected version range spans from Release 2020 through Release 2025, indicating this is a longstanding architectural weakness in DELMIA Apriso's access control model rather than a recently introduced regression. The Scope (Unchanged) metric, in contrast to CVE-2025-6204's Changed Scope, indicates the direct impact is contained within the Apriso application boundary, though the practical consequences of unauthorized access to a manufacturing execution system extend broadly to production operations.
Frequently Asked Questions
What is CVE-2025-6205?
CVE-2025-6205 is a critical missing authorization vulnerability in Dassault Systemes DELMIA Apriso that allows unauthenticated remote attackers to gain privileged access to the manufacturing execution system. No credentials are required, making this a particularly dangerous flaw for any exposed DELMIA Apriso installation.
How does CVE-2025-6205 differ from CVE-2025-6204?
While both vulnerabilities affect DELMIA Apriso across the same version range, CVE-2025-6205 is more dangerous because it requires no authentication (CVSS 9.1 vs 8.0). CVE-2025-6204 is a code injection flaw that requires high-privilege access and high attack complexity, while CVE-2025-6205 allows unauthenticated access directly. Organizations should patch both vulnerabilities.
What industries are most at risk?
DELMIA Apriso is used across manufacturing industries including automotive, aerospace, defense, pharmaceuticals, medical devices, and electronics. Any organization using DELMIA Apriso for production management is at risk. Industries with strict regulatory requirements (pharmaceuticals, aerospace) face additional compliance implications from unauthorized access to manufacturing data.
What should I do if my DELMIA Apriso instance was exposed?
If your DELMIA Apriso instance was accessible from untrusted networks while running an affected version, assume it has been compromised. Audit all access logs for unauthorized requests, check for modified production data or configurations, review user accounts for unauthorized additions, and consider engaging an incident response team to perform a thorough forensic investigation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.