Vulnerability in Autodesk Advance Steel
CVE-2024-37002
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
EPSS: 0.004 (31.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Autodesk Advance Steel — versions 2025, 2024, 2023
- Autodesk Advance_steel
- Autodesk Autocad — versions 2025, 2024, 2023
- Autodesk Autocad Architecture — versions 2025, 2024, 2023
- Autodesk Autocad_architecture
- Autodesk Autocad Electrical — versions 2025, 2024, 2023
- Autodesk Autocad_electrical
- Autodesk Autocad Map 3d — versions 2025, 2024, 2023
- Autodesk Autocad_map_3d
- Autodesk Autocad Mechanical — versions 2025, 2024, 2023
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@autodesk.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-37002?
- CVE-2024-37002 is a high-severity vulnerability in Autodesk Advance Steel, classified under CWE-457. CVSS score: 7.8/10. Published 2024-06-25.
- How severe is CVE-2024-37002?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2024-37002 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.