The version of Autodesk Navisworks Simulate installed on the remote host is prior to 2025.4. It is, therefore, affected by multiple vulnerabilities as referenced in the adsk-sa-2024-0027 advisory.

  - A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds     Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data     corruption, or execute arbitrary code in the context of the current process.     (CVE-2024-11422, CVE-2024-12191, CVE-2024-12193, CVE-2024-12197, CVE-2024-12198, CVE-2024-12199,     CVE-2024-12200, CVE-2024-12671)

  - A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption     vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context     of the current process. (CVE-2024-12178, CVE-2024-12194)

  - A maliciously crafted DWF file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds     Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data     corruption, or execute arbitrary code in the context of the current process. (CVE-2024-12192)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Autodesk Navisworks Simulate 25.0.x < 2025.4 Multiple Vulnerabilities (adsk-sa-2024-0027)

high Nessus Plugin ID 213279

Version 1.2

Version 1.1

Version 1.2 Dec 23, 2024, 9:17 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") Exploit attributes ("Exploit available" set to "False") Exploit attributes ("Exploitability ease" set to "No known exploits are available") Plugin Feed: 202412230917
Version 1.1 Dec 20, 2024, 12:27 PM New Plugin Feed: 202412201227