CVE-2021-27030

What it actually does

This vulnerability is a directory traversal leading to arbitrary code execution in Autodesk FBX Review when a user opens a crafted FBX file. The malicious file can cause the application to write or load content outside the intended directory boundaries and execute attacker-controlled code with the privileges of the user running FBX Review. Because exploitation requires opening a malicious file, the attack vector is local/user-assisted rather than directly network-exploitable, but successful exploitation can provide full confidentiality, integrity, and availability impact on the affected workstation.

Why it matters to the business

An attacker who convinces a user to open a malicious 3D model file could take control of that user's workstation, steal files or credentials accessible to that user, install malware, or use the system as a foothold for broader compromise. This is most relevant to organizations that receive FBX or 3D asset files from external parties, including media, design, engineering, gaming, manufacturing, and architecture workflows. The EPSS score is relatively high, indicating meaningful probability of exploitation activity despite the lack of CISA KEV listing, so exposed workflows should be treated as a priority even though the vulnerability is older.

How an attack unfolds

An attacker prepares a malicious FBX file designed to abuse directory traversal behavior in Autodesk FBX Review. The file is then delivered through a likely content-sharing path such as email, shared storage, collaboration portals, asset marketplaces, or project handoff packages. When a user opens the file in FBX Review, the application processes attacker-controlled paths or embedded content in an unsafe way, allowing code or supporting files to be placed or referenced outside the expected location. The payload then executes in the context of the logged-in user. From there, the attacker may run commands, download additional tools, steal data, establish persistence, or attempt privilege escalation and lateral movement depending on local permissions and security controls.

How to fix it

Upgrade Autodesk FBX Review to a vendor-supported version that includes the security fix, if available from Autodesk. If no fixed version is available for the installed release, remove FBX Review from systems that do not require it or replace it with a supported viewer. Restrict opening of FBX files from untrusted sources, especially files received by email, downloaded from the internet, or obtained from third-party asset repositories. Remove automatic file association with FBX Review where possible. Use application control to prevent FBX Review from launching scripting engines, command interpreters, or unexpected child processes. Open untrusted 3D assets only in a sandboxed or isolated environment. Ensure endpoint protection, exploit protection, and attachment scanning are enabled for workstations handling 3D content.

How to confirm the fix worked

Confirm whether Autodesk FBX Review is installed and determine the installed version across managed endpoints. Compare installed versions against Autodesk security advisories and any available vendor-provided fixed builds. Validate that unsupported or vulnerable installations have been removed, upgraded, or isolated. Test that FBX files from untrusted locations are blocked, quarantined, or opened only in a sandboxed workflow. Verify endpoint controls prevent FBX Review from spawning command interpreters, script hosts, download utilities, or unsigned executables. Review software inventory, file association settings, and application-control policy enforcement to confirm exposure has been reduced.

Typical attack path

1. Identify an organization or user likely to open FBX/3D asset files.
2. Create a specially crafted malicious FBX file that abuses directory traversal behavior in FBX Review.
3. Deliver the file through phishing, a file-sharing platform, a supplier/customer exchange, or a compromised asset repository.
4. Convince the user to open the file with Autodesk FBX Review.
5. Trigger arbitrary code execution under the user's security context.
6. Execute a payload such as a downloader, reverse shell, credential stealer, or persistence mechanism.
7. Use the compromised workstation to access local files, cloud sessions, internal resources, or additional systems.

How to detect it

Look for signs that Autodesk FBX Review opened an untrusted FBX file and then launched unexpected processes or wrote executable content to user-writable locations. Useful log sources include EDR process telemetry, Windows Security event logs, Sysmon logs, email gateway logs, web proxy logs, file download records, and endpoint file-creation events. Focus on parent-child process relationships where FBX Review starts command shells, scripting engines, living-off-the-land binaries, archive tools, or network download utilities. Review recent .fbx files received by email, downloaded from browsers, extracted from archives, or opened from collaboration folders. Investigate file creation shortly after FBX Review execution in Startup folders, Temp directories, AppData paths, Downloads, Desktop, or other user-writable locations. Because no public exploit-specific marker is provided, detection should be behavior-based rather than relying on a single unique signature.

• FBXReview.exe
• fbxreview.exe
• .fbx
• FBXReview.exe -> cmd.exe
• FBXReview.exe -> powershell.exe
• FBXReview.exe -> wscript.exe
• FBXReview.exe -> cscript.exe
• FBXReview.exe -> mshta.exe
• FBXReview.exe -> rundll32.exe
• FBXReview.exe -> regsvr32.exe
• FBXReview.exe -> certutil.exe
• FBXReview.exe -> bitsadmin.exe
• FBXReview.exe -> curl.exe
• FBXReview.exe -> wget.exe
• FBXReview.exe -> conhost.exe
• C:\Users\*\AppData\Local\Temp\*.exe
• C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk
• C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe

What your security team should do

• Inventory endpoints for Autodesk FBX Review installations and prioritize systems used for design, media, engineering, or external asset review workflows.
• Upgrade to a vendor-fixed release where available; otherwise remove or isolate FBX Review on systems where it is not strictly required.
• Treat externally sourced FBX files as high-risk content and require sandboxing or malware scanning before opening.
• Create endpoint detection rules for FBX Review spawning suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, or curl.exe.
• Hunt historical endpoint telemetry for suspicious FBX Review process activity, especially around the time users opened externally received .fbx files.
• Block or warn on FBX attachments and downloaded FBX files from untrusted senders or newly registered domains.
• Apply least-privilege controls so users who open 3D assets do not have unnecessary administrative rights.
• Use application allowlisting or attack surface reduction rules to limit post-exploitation payload execution from user-writable directories.