CVE-2025-10244
📋 TL;DR
A stored cross-site scripting vulnerability in Autodesk Fusion allows malicious HTML payloads to execute arbitrary code when rendered by the application. This could enable attackers to read local files or execute commands within the current process context. All users running vulnerable versions of Autodesk Fusion are affected.
💻 Affected Systems
- Autodesk Fusion
📦 What is this software?
Fusion by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution, data exfiltration, and lateral movement within the network.
Likely Case
Local file read and limited code execution within the application's process context, potentially leading to credential theft or further exploitation.
If Mitigated
Limited impact with proper input validation and output encoding, though some information disclosure may still occur.
🎯 Exploit Status
Exploitation requires user interaction with malicious content within the application
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0020
Restart Required: Yes
Instructions:
1. Visit the Autodesk Trust Center advisory
2. Download and install the latest version of Autodesk Fusion
3. Restart the application and verify update
🔧 Temporary Workarounds
Disable HTML rendering features
allConfigure application to disable or restrict HTML content rendering capabilities
Application sandboxing
allRun Autodesk Fusion in restricted/sandboxed environment to limit potential damage
🧯 If You Can't Patch
- Restrict user access to untrusted content sources within the application
- Implement network segmentation to isolate vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check current Autodesk Fusion version against vendor advisory for vulnerable versionsCheck Version:
Check Help > About in Autodesk Fusion applicationVerify Fix Applied:
Verify installed version matches or exceeds patched version specified in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from Autodesk Fusion process
- Suspicious process creation by Autodesk Fusion
Network Indicators:
- Unexpected outbound connections from Autodesk Fusion to external servers
SIEM Query:
Process creation where parent process contains 'Fusion' AND (command line contains suspicious patterns OR destination IP is external)