CVE-2025-10553: DELMIA Factory Resource Manager XSS Flaw

CVE-2025-10553 Overview

A Stored Cross-site Scripting (XSS) vulnerability has been identified in DELMIA Factory Resource Manager, a component of the Dassault Systèmes 3DEXPERIENCE platform used for factory resource management. This vulnerability allows an attacker to inject and persistently store malicious script code that executes in the browser session of users who access the affected resource management functionality.

Stored XSS vulnerabilities are particularly dangerous because the malicious payload is saved on the target server and delivered to every user who views the compromised content, enabling widespread impact without requiring the attacker to directly target each victim.

Critical Impact

Attackers can execute arbitrary JavaScript in authenticated user sessions, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of users, and data exfiltration from the manufacturing management platform.

Affected Products

• DELMIA Factory Resource Manager Release 3DEXPERIENCE R2023x
• DELMIA Factory Resource Manager Release 3DEXPERIENCE R2024x
• DELMIA Factory Resource Manager Release 3DEXPERIENCE R2025x

Discovery Timeline

• 2026-03-31 - CVE-2025-10553 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-10553

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-site Scripting. The stored variant of XSS occurs when user-supplied input containing malicious script code is permanently saved on the target application and later rendered to other users without proper sanitization or encoding.

In the context of DELMIA Factory Resource Manager, the vulnerability exists within the Factory Resource Management functionality. When users interact with resource management features, malicious script code injected by an attacker is stored and subsequently executed when other users access the same resources. This allows attackers to perform actions in the context of authenticated users, including administrators who may have elevated privileges within the manufacturing management system.

The attack requires low privileges for initial access and user interaction to trigger the payload execution, but the scope extends beyond the vulnerable component, potentially impacting confidentiality and integrity of user sessions and data.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Factory Resource Management module. The application fails to properly sanitize user-supplied input before storing it in the database and does not adequately encode this data when rendering it in the user interface. This allows specially crafted HTML and JavaScript code to be interpreted and executed by the victim's browser rather than being displayed as harmless text.

Attack Vector

The attack is network-based and follows a typical stored XSS exploitation pattern:

1. An authenticated attacker with low privileges identifies input fields within the Factory Resource Management interface that accept and store user data
2. The attacker crafts a malicious payload containing JavaScript code designed to perform unauthorized actions
3. The payload is submitted and stored in the application database
4. When legitimate users access the affected resource or page, the malicious script is served as part of the page content
5. The victim's browser executes the injected script in the context of their authenticated session, allowing the attacker to steal session tokens, perform actions on behalf of the user, or redirect the user to malicious sites

This vulnerability leverages the trust relationship between the browser and the authenticated web application, enabling attackers to bypass same-origin policy restrictions.

Detection Methods for CVE-2025-10553

Indicators of Compromise

• Unusual JavaScript code or HTML tags stored in database fields associated with Factory Resource Management resources
• User reports of unexpected browser behavior, pop-ups, or redirects when accessing the DELMIA platform
• Web application firewall logs showing blocked XSS attack patterns targeting the Factory Resource Manager endpoints
• Session anomalies indicating potential token theft or session hijacking

Detection Strategies

• Enable and review web application firewall (WAF) logs for XSS attack signatures targeting DELMIA endpoints
• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports
• Conduct regular security audits of stored data fields for suspicious HTML or JavaScript content
• Deploy browser-side XSS detection mechanisms that alert on unexpected script execution

Monitoring Recommendations

• Monitor HTTP traffic for encoded script tags and common XSS payloads in request parameters
• Enable detailed application logging for all user input operations within Factory Resource Management
• Set up alerts for unusual cross-domain requests or data exfiltration patterns from the DELMIA platform
• Review user session patterns for signs of session hijacking following exploitation

How to Mitigate CVE-2025-10553

Immediate Actions Required

• Apply the latest security patches from Dassault Systèmes for affected DELMIA Factory Resource Manager versions
• Implement Content Security Policy (CSP) headers to restrict script execution sources
• Enable HttpOnly and Secure flags on all session cookies to limit the impact of session theft
• Conduct a review of existing stored data for potential malicious content injection

Patch Information

Dassault Systèmes has released a security advisory addressing this vulnerability. Organizations running DELMIA Factory Resource Manager versions R2023x through R2025x should consult the 3DS Security Advisory for CVE-2025-10553 for detailed patching instructions and updated software versions. It is critical to apply vendor-supplied patches as soon as possible to remediate this vulnerability.

Workarounds

• Deploy a web application firewall (WAF) with XSS filtering rules as an interim protective measure
• Implement strict Content Security Policy headers to prevent inline script execution
• Restrict access to Factory Resource Management features to trusted users only until patches are applied
• Consider implementing additional input validation at the network perimeter level

# Example Content Security Policy header configuration
# Add to web server configuration (Apache/Nginx)
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';