CVE-2025-9976

An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976

Configurations

No configuration.

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos del sistema operativo que afecta a la aplicación Station Launcher en la plataforma 3DEXPERIENCE desde la versión 3DEXPERIENCE R2022x hasta la versión 3DEXPERIENCE R2025x podría permitir a un atacante ejecutar código arbitrario en la máquina del usuario.

Information

Published : 2025-10-13 08:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-9976

Mitre link : CVE-2025-9976

CVE.ORG link : CVE-2025-9976

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-9976", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9976", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T13:15:28.135588Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "3DS.Information-Security@3ds.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "3DS.Information-Security@3ds.com", "affectedData": [{"vendor": "Dassault Syst\u00e8mes", "product": "Station Launcher App in 3DEXPERIENCE platform", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2540"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2532"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2537"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2025x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2025x.FP.CFA.2532"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-13T08:15:41.547", "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976", "source": "3DS.Information-Security@3ds.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "3DS.Information-Security@3ds.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo que afecta a la aplicaci\u00f3n Station Launcher en la plataforma 3DEXPERIENCE desde la versi\u00f3n 3DEXPERIENCE R2022x hasta la versi\u00f3n 3DEXPERIENCE R2025x podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario en la m\u00e1quina del usuario."}], "lastModified": "2026-09-26T00:10:00.127", "sourceIdentifier": "3DS.Information-Security@3ds.com"}