CVE-2024-9489
📋 TL;DR
This vulnerability allows attackers to exploit a memory corruption flaw in AutoCAD by tricking users into opening malicious DWG files. Successful exploitation could lead to arbitrary code execution, data theft, or system crashes. All AutoCAD users who open untrusted DWG files are affected.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Dwg Trueview by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the AutoCAD process, potentially leading to full system compromise.
Likely Case
Application crash or limited data exposure when users open malicious files from untrusted sources.
If Mitigated
No impact if users only open trusted DWG files and have proper security controls.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious DWG file. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2024-0021 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
Restart Required: Yes
Instructions:
1. Open AutoCAD. 2. Navigate to Help > About. 3. Check for updates. 4. Download and install the latest security update from Autodesk. 5. Restart AutoCAD.
🔧 Temporary Workarounds
Disable automatic DWG file opening
windowsPrevent AutoCAD from automatically opening DWG files from untrusted sources
Use file type restrictions
allConfigure system to only allow trusted DWG files to be opened with AutoCAD
🧯 If You Can't Patch
- Implement strict file handling policies to only open DWG files from trusted sources
- Use application whitelisting to restrict AutoCAD execution to specific users and systems
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against patched versions listed in Autodesk Security Advisory ADSK-SA-2024-0021Check Version:
In AutoCAD: Help > About, or on command line: acad.exe /versionVerify Fix Applied:
Verify AutoCAD version is updated to the patched version specified in the advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes in AutoCAD with memory access violations
- Unexpected process termination of acad.exe
Network Indicators:
- Unusual network connections originating from AutoCAD process
- Downloads of DWG files from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="acad.exe" AND ExceptionCode="0xc0000005"