by Kastro
Paper/Archive/CVE-2025-9976

CVE-2025-9976

Dassault Systèmes Station Launcher App in 3DEXPERIENCE platform — OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

EPSS 0.9%CVSS 9.0
critical.is priorityof 100
39
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 59.8.598 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.

Affected

ProductAffectedFixed inSource
Station Launcher App in 3DEXPERIENCE platformRelease 3DEXPERIENCE R2022x Golden – Release 3DEXPERIENCE R2022x.FP.CFA.2540–CNA
Station Launcher App in 3DEXPERIENCE platformRelease 3DEXPERIENCE R2023x Golden – Release 3DEXPERIENCE R2023x.FP.CFA.2532–CNA
Station Launcher App in 3DEXPERIENCE platformRelease 3DEXPERIENCE R2024x Golden – Release 3DEXPERIENCE R2024x.FP.CFA.2537–CNA
Station Launcher App in 3DEXPERIENCE platformRelease 3DEXPERIENCE R2025x Golden – Release 3DEXPERIENCE R2025x.FP.CFA.2532–CNA

Scores by source

3DS (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

ref3ds.com/trust-center/security/security-advisories/cve-2025-9976