Delmia Factory Resource Manager CVE-2025-10553

The CVSS 8.7 High severity score is primarily driven by the changed scope (S:C) and high confidentiality and integrity impact, though actual exploitation requires low-privilege authentication (PR:L) and user interaction (UI:R). The network attack vector (AV:N) and low complexity (AC:L) indicate the vulnerability is remotely exploitable without special conditions once authenticated. However, real-world risk assessment reveals moderate urgency factors: the requirement for authenticated access and victim interaction creates natural barriers to mass exploitation. No EPSS score was provided, but typical stored XSS in enterprise applications shows moderate exploitation probability due to authentication gates. CISA KEV does not list this CVE, confirming no confirmed active exploitation in the wild. No public proof-of-concept code is identified in available intelligence. From an SSVC perspective, this rates as medium-priority: exploitation requires authentication and social engineering (not fully automatable), technical impact is significant within manufacturing planning environments but scoped to session hijacking and data theft rather than system compromise, and no evidence of active exploitation exists. Organizations using DELMIA for critical manufacturing operations should prioritize this based on the high value of intellectual property and production data accessible through compromised sessions.

An authenticated attacker with low-level privileges in the DELMIA Factory Resource Manager creates or modifies a factory resource definition (such as a machine specification, production line configuration, or resource attribute) and injects malicious JavaScript code into input fields that accept free-text descriptions or custom properties. Because the application fails to properly sanitize this input before storing it, the malicious script persists in the database. When other users-including administrators or manufacturing engineers with elevated privileges-subsequently view or interact with this resource through the Factory Resource Management interface, the stored script executes in their browser contexts. The changed scope impact allows the attacker's script to access session tokens, authentication cookies, or data from adjacent 3DEXPERIENCE platform components, enabling session hijacking, privilege escalation, or exfiltration of sensitive manufacturing data and intellectual property. No public exploit code exists, but the low attack complexity means exploitation requires only basic XSS knowledge and valid user credentials.