The ADP Desktop SDK contains a flaw where sensitive information is sent over the network in a readable form. Based on the description, it could capture credentials or other protected data by observing network traffic, leading to confidentiality compromise and facilitating unauthorized access to Autodesk services. The weakness directly maps to the type of cleartext storage or transmission of information.

Autodesk ADP Desktop SDK versions 5.0.0, 6.0.0, and 7.0.0 are affected. Any deployment of these SDK versions may transmit sensitive data without encryption, exposing the information to interception.

With a CVSS score of 7.5, the vulnerability is considered moderately severe. The EPSS score is < 1%, indicating a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog, implying no publicly documented exploits yet. Based on the description, the likely attack vector is an attacker who can observe network traffic or inject packets to acquire credentials or other secrets, potentially enabling further unauthorized actions against Autodesk services.