DELMIA Apriso - RCE (CVE-2025-6204)
Description
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
psychologyCrowdSec Analysis
CVE-2025-6204 is a code injection vulnerability in DELMIA Apriso versions 2020 through 2025, which could allow attackers to execute arbitrary code on affected systems. Exploiting this flaw may enable threat actors to compromise system integrity, access sensitive data, or disrupt operations within industrial environments.
CrowdSec has been tracking this vulnerability and its exploits since 1st of October 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-6204 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit DELMIA Apriso instances by uploading malicious files via the /Apriso/webservices/1.1/operation.svc/UploadFile endpoint, often using path traversal in the filename parameter to place executable files (such as .asp) into web-accessible directories like /Apriso/Portal/Uploads/, enabling remote code execution when the uploaded file is accessed.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-08-04 |
| Rule Released | 2025-10-01 |
| CISA KEV | 2025-10-28 |
| CrowdSec First Seen | 2025-11-18 |
| CISA Remediation Deadline | 2025-11-18 |