External risk intelligence

DELMIA Apriso Code Injection Vulnerability.

CVE advisoryKnown Exploit

CVE-2025-6204

DELMIA Apriso is a manufacturing execution system (MES) primarily deployed within internal corporate or industrial facility networks to manage production processes. While it may have network connectivity, it is typically protected by internal controls and is not designed to be exposed directly to the public internet in standard deployment patterns.

Code Injection

3ds Delmia Apriso

2020 to 2025

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Certain versions of DELMIA Apriso are affected by a vulnerability related to improper control of code generation. This flaw could enable an attacker to introduce and execute unauthorized code within the affected systems. The main business impact could include unauthorized code execution, potentially leading to system compromise and data manipulation.

Vulnerable software component: DELMIA Apriso
Core weakness: Code injection
Main business impact: Arbitrary code execution

Attack Path

How an attacker could exploit the issue

An attacker could execute arbitrary code within DELMIA Apriso systems through a code injection vulnerability. Successful exploitation requires an attacker to have administrative privileges and network access to the affected system. This attack could lead to the compromise of sensitive data and disruption of critical business operations.

Requires administrative access.
Attacker triggers code execution.
Results in arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability exists in DELMIA Apriso that could allow for the execution of arbitrary code. This could enable an attacker to gain control of the affected system. Organizations using the specified versions of DELMIA Apriso should consider this a significant risk.

Attackers with high skill level.
Requires authenticated access.
High business risk or urgency.

Operational Fix

Recommended remediation, mitigation, and detection steps

An organization should address a critical code injection vulnerability affecting DELMIA Apriso versions 2020 through 2025. This vulnerability allows an attacker to execute arbitrary code, posing a significant risk to system integrity and data security. Swift action is necessary to identify and mitigate this exposure.

Find affected DELMIA Apriso assets.
Reduce exposure or isolate affected systems.
Apply vendor fix, verify, and monitor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DELMIA Apriso and what is it used for?

DELMIA Apriso is a manufacturing execution system (MES) software used for managing and monitoring production processes within industrial facilities. It helps businesses track and control operations on the factory floor.

What kind of vulnerability does CVE-2025-6204 describe?

CVE-2025-6204 describes an Improper Control of Generation of Code vulnerability, commonly known as code injection. This weakness allows an attacker to insert and run their own code on the affected system.

What are the conditions for an attacker to exploit this DELMIA Apriso vulnerability?

Exploiting this vulnerability requires an attacker to have administrative privileges on the DELMIA Apriso system and network access to it. It does not trigger if the attacker lacks these prerequisites.

Who should be concerned about DELMIA Apriso's CVE-2025-6204 vulnerability?

Organizations using DELMIA Apriso versions 2020 through 2025 should be concerned. Based on Halo Surface Signal, DELMIA Apriso is typically an internal system, suggesting the primary risk is to internal networks rather than direct internet exposure.

What is the first step to address the DELMIA Apriso code injection flaw?

The first step is to identify all DELMIA Apriso assets running versions 2020 through 2025 within your environment. Subsequently, consider isolating affected systems or applying vendor-provided fixes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.