ZDI-CAN-22624: ZDI-24-435: Dassault Systèmes eDrawings Viewer DXF File Parsing Type Confusion Remote Code Execution Vulnerability

Published May 9, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-3298.

Affected Software

1 affected component

Dassault Systèmes eDrawings Viewer

Event History

May 9, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-22624?

ZDI-CAN-22624 is a critical vulnerability that allows remote code execution.

How do I fix ZDI-CAN-22624?

To mitigate ZDI-CAN-22624, ensure that you update to the latest version of Dassault Systèmes eDrawings Viewer.

What types of attacks can exploit ZDI-CAN-22624?

ZDI-CAN-22624 can be exploited through malicious web pages or files that require user interaction.

Do I need to interact with a malicious file to exploit ZDI-CAN-22624?

Yes, user interaction is necessary to exploit ZDI-CAN-22624 by visiting a malicious page or opening a harmful file.

Which software is affected by ZDI-CAN-22624?

The affected software for ZDI-CAN-22624 is Dassault Systèmes eDrawings Viewer.