CVE-2025-27379 is a stored cross-site scripting (XSS) vulnerability classified under CWE-79 found in Altium AES version 7.0.3. The vulnerability exists in the Bill of Materials (BOM) Viewer component, where the Description field of a schematic does not properly sanitize user input. An authenticated attacker with at least limited privileges can inject arbitrary JavaScript code into this field. When other users view the affected schematic in the BOM Viewer, the malicious script executes in their browser context. This can lead to various impacts including session hijacking, unauthorized actions on behalf of the user, or denial of service by disrupting the availability of the BOM Viewer. The vulnerability requires authentication and user interaction (viewing the schematic), which limits its exploitation scope but does not eliminate risk. The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) reflects network attack vector, low attack complexity, privileges required, user interaction required, unchanged scope, low confidentiality and integrity impact, but high availability impact. No patches or exploits are currently publicly available, but the vulnerability is published and should be addressed promptly. This vulnerability is particularly relevant for organizations relying on Altium AES for electronic design automation, as it could be leveraged for lateral movement or disruption within engineering teams.

For European organizations, the impact of CVE-2025-27379 can be significant in sectors that rely heavily on Altium AES for electronic design and manufacturing, such as automotive, aerospace, telecommunications, and industrial equipment. Exploitation could lead to unauthorized script execution within the BOM Viewer, potentially allowing attackers to steal session tokens, perform actions on behalf of users, or disrupt availability of critical design data. This could delay product development cycles, cause intellectual property exposure, or introduce integrity issues in design documentation. The requirement for authentication and user interaction reduces the likelihood of widespread automated exploitation but does not eliminate targeted attacks, especially insider threats or compromised accounts. Given the interconnected nature of supply chains in Europe, a successful attack could propagate risks downstream to partners and customers. Availability impact is rated high, which could affect operational continuity in engineering workflows. Confidentiality and integrity impacts are lower but still relevant due to potential data exposure or manipulation.

1. Upgrade to a patched version of Altium AES once available; monitor vendor advisories closely. 2. Implement strict access controls limiting who can authenticate and edit schematics, especially the Description field. 3. Enforce input validation and sanitization on the Description field to prevent injection of malicious scripts. 4. Use Content Security Policy (CSP) headers to restrict execution of unauthorized scripts in the BOM Viewer interface. 5. Monitor logs and user activity for unusual behavior indicative of exploitation attempts, such as unexpected script injections or anomalous access patterns. 6. Educate users to be cautious when viewing schematics from untrusted sources or unknown authors. 7. Consider network segmentation to isolate Altium AES servers from broader corporate networks to limit lateral movement. 8. Employ multi-factor authentication to reduce risk from compromised credentials. 9. Regularly back up design data to enable recovery in case of availability disruption. 10. If patching is delayed, consider disabling or restricting access to the BOM Viewer component temporarily.