Multiple vulnerabilities in Autodesk AutoCAD products



| Updated: 2024-08-05
Risk High
Patch available NO
Number of vulnerabilities 11
CVE-ID CVE-2024-23150
CVE-2024-23151
CVE-2024-23152
CVE-2024-23153
CVE-2024-23154
CVE-2024-23155
CVE-2024-23156
CVE-2024-23157
CVE-2024-23158
CVE-2024-23159
CVE-2024-36999
CWE-ID CWE-787
CWE-125
CWE-122
CWE-119
CWE-416
CWE-457
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Autodesk AutoCAD
Other software / Other software solutions

AutoCAD Architecture
Client/Desktop applications / Multimedia software

AutoCAD Electrical
Client/Desktop applications / Multimedia software

AutoCAD Map 3D
Client/Desktop applications / Multimedia software

AutoCAD Mechanical
Client/Desktop applications / Multimedia software

AutoCAD MEP
Client/Desktop applications / Multimedia software

AutoCAD Plant 3D
Client/Desktop applications / Multimedia software

Autodesk Civil 3D
Client/Desktop applications / Multimedia software

Advance Steel
Client/Desktop applications / Multimedia software

Vendor Autodesk

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Out-of-bounds write

EUVDB-ID: #VU92230

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23150

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PRT files in odxug_dll.dll. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-792/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU92231

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23151

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing 3DM files in ASMkern229A.dll. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-793/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU92232

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23152

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing 3DM files in opennurbs.dll. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds read and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-797/
https://www.zerodayinitiative.com/advisories/ZDI-24-791/
https://www.zerodayinitiative.com/advisories/ZDI-24-788/
https://www.zerodayinitiative.com/advisories/ZDI-24-960/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU92233

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23153

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing MODEL files in libodx.dll. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds read and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-795/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Heap-based buffer overflow

EUVDB-ID: #VU92234

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23154

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing SLDPRT files in ODXSW_DLL.dll. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-790/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Heap-based buffer overflow

EUVDB-ID: #VU92235

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23155

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing MODEL files in atf_asm_interface.dll. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-787/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU92236

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23156

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing 3DM files in opennurbs.dll. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-799/
https://www.zerodayinitiative.com/advisories/ZDI-24-796/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU92240

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23157

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing SLDASM and SLDPRT files in ODXSW_DLL.dll. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-800/
https://www.zerodayinitiative.com/advisories/ZDI-24-685/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU92237

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23158

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when parsing IGES files in ASMImport229A.dll. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-798/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use of Uninitialized Variable

EUVDB-ID: #VU92238

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-23159

CWE-ID: CWE-457 - Use of Uninitialized Variable

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing STP files in stp_aim_x64_vc15d.dll. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-794/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds write

EUVDB-ID: #VU92239

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-36999

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing 3DM files in opennurbs.dll. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Autodesk AutoCAD: 2024 - 2024.1.4

AutoCAD Architecture: 2024 - 2024.1.4

AutoCAD Electrical: 2024 - 2024.1.4

AutoCAD Map 3D: 2024 - 2024.1.4

AutoCAD Mechanical: 2024 - 2024.1.4

AutoCAD MEP: 2024 - 2024.1.4

AutoCAD Plant 3D: 2024 - 2024.1.4

Autodesk Civil 3D: 2024 - 2024.1.4

Advance Steel: 2024 - 2024.1.4

CPE2.3 External links

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
https://www.zerodayinitiative.com/advisories/ZDI-24-789/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###