CVE-2025-6204

CVE Enrichment

CVSS: 8.0 HIGH
EPSS: 79.34%
EPSS Percentile: 99.60%
CISA KEV: YES — Known Exploited Vulnerability

Description

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 3DS.Information-Security@3ds.com
Published: 04-Aug-2025 17:15
Last Modified: 17-Jun-2026 17:01
EPSS Date: 2026-10-16
CWE: CWE-94

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:H /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-10-28
Remediation Due: 2025-11-18
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6204

Affected Products / Versions

3ds / delmia_apriso
Version / affected range: * · from (inclusive) 2020 · through (inclusive) 2025
cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*

References

Last enrichment sync: 17-Oct-2026 07:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications. Cybersecurity Roundup: Ransomware Prosecutions, Exploited Flaws and New Threat Activity
The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications. DarkOwl’s October Threat Intelligence Roundup Covers Breaches, Malware and Exploits

CVE (2)

Malware (8)

People (5)

Threat Actors (11)

MITRE ATT&CK (5)

Vendors (3)

Products (14)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.