The version of Autodesk AutoCAD installed on the remote Windows host is a version prior to 2025.1.1. It is, therefore, affected by multiple vulnerabilities:

  - A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk affected applications can force a     Heap-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash,     write sensitive data, or execute arbitrary code in the context of the current process. (CVE-2024-8587)

  - A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk affected applications can force     an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write     sensitive data, or execute arbitrary code in the context of the current process. (CVE-2024-8588)

  - A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk affected applications can force an     Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write     sensitive data, or execute arbitrary code in the context of the current process. (CVE-2024-8589)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Autodesk Multiple Vulnerabilities (AutoCAD) (adsk-sa-2024-0019) (adsk-sa-2024-0021)

high Nessus Plugin ID 210051

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Mar 21, 2025, 12:03 PM IAVM reference Plugin Feed: 202503211203
Version 1.2 Nov 4, 2024, 10:01 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2024-8587" to "CVE-2024-9997") Exploit attributes ("Exploit available" set to "False") Exploit attributes ("Exploitability ease" set to "No known exploits are available") Plugin Feed: 202411041001
Version 1.1 Nov 1, 2024, 3:44 PM New Plugin Feed: 202411011544