RCE in Autodesk Vred

CVE-2014-2967

Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.051 (91.4th percentile) — read the EPSS interpretation.

Affected products

Autodesk Vred — versions 2014
N/a — versions n/a

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)