CVE-2024-3300 is a critical pre-authentication remote code execution vulnerability affecting DELMIA Apriso Release 2019 through Release 2024, stemming from an unsafe .NET object deserialization flaw. With a CVSS score of 9.0, this vulnerability allows unauthenticated attackers to execute arbitrary code remotely with high impact on confidentiality, integrity, and availability, albeit with high attack complexity. While not yet observed in active exploitation or listed in CISA's KEV catalog, public Nuclei templates exist, indicating potential for future exploitation and warranting immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Dassault SystèMes | DELMIA Apriso | >= Release 2019 Golden, <= Release 2019 SP5, >= Release 2020 Golden, <= Release 2020 SP4, >= Release 2021 Golden, <= Release 2021 SP3, >= Release 2022 Golden, <= Release 2022 SP3, >= Release 2023 Golden, <= Release 2023 SP2, >= Release 2024 Golden, <= Release 2024 SP1CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.4 Reddit, 1.2 Bluesky, 0.9 Mastodon, and 2.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.8 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.