3DSwymer CVE-2025-10558

Exploitation targets the 3DSearch feature of Dassault Systèmes 3DSwymer on 3DEXPERIENCE Release R2025x specifically. The attacker must be able to persist a script payload into stored content surfaced by 3DSearch, and successful execution requires a second victim user to load the affected 3DSearch view (UI:R) - it is not a one-shot automatic trigger. Impact is bounded by the browser's same-origin/session context (C:L/I:L, A:N), so it enables session-context script actions rather than direct server compromise. The vendor's PR:N rating implies no authentication is needed to inject, but stored XSS normally requires an account with content-write access; confirm the actual privilege prerequisite with the vendor before treating it as fully unauthenticated.

This is a stored Cross-site Scripting (CWE-79) flaw with a vendor-assigned CVSS 3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - network vector, low complexity, no privileges, but requiring user interaction, with a scope change and only Low confidentiality and integrity impact. The signals converge on a genuinely medium, not critical, priority: EPSS is 0.20% (9th percentile), indicating very low modeled probability of exploitation; the CVE is NOT on the CISA KEV catalog; and no public exploit (POC) is identified. There is a notable internal tension worth verifying: the vendor rates PR:N (unauthenticated), yet stored XSS normally requires an attacker to place a persistent payload into application-stored content, which in an enterprise collaboration product like 3DSwymer typically presupposes an authenticated account with content-creation rights - the PR:N rating may reflect an unauthenticated injection path (e.g., a publicly writable field) that is not described, so the privilege prerequisite should be confirmed with Dassault Systèmes. The S:C (scope change) correctly captures that injected script executes in the victim's browser authentication context rather than the vulnerable component's. Net assessment: a real but moderate issue - patch within normal cycles; it is a high-UI-dependent, low-impact stored XSS rather than a widespread, automatable threat.

An attacker with access to a content field in the 3DSearch feature of 3DSwymer stores a malicious script payload; when another 3DEXPERIENCE user later views the affected content, the script executes in that victim's authenticated browser session, enabling session-token theft or actions performed as the victim. Exploitation requires the victim to view the poisoned content (UI:R), and no public exploit code has been identified at time of analysis.