Adp Desktop Sdk
Monthly
Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.
Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.