A maliciously crafted add‑in installed into Autodesk Fusion Desktop can silently change the application’s persistent network proxy settings. By redirecting authenticated Fusion traffic through an attacker‑controlled proxy, the adversary can intercept and potentially compromise sensitive data exchanged with Autodesk services. This vulnerability effectively turns the user’s own environment into a gateway for eavesdropping or manipulation of legitimate traffic.

The affected product is Autodesk Fusion Desktop, specifically version 2705 as indicated by the associated CPE string. No other versions or variants are listed as impacted in the provided data.

The vulnerability carries a CVSS score of 8.6, indicating high severity, but its EPSS score is not available. It is not listed in the CISA KEV catalog. The attack vector is inferred to be a local execution of a malicious add‑in; therefore, the prerequisite is that the add‑in is installed and executed by the user or through a supply‑chain compromise. Once the add‑in runs, it can modify proxy settings without notice, enabling traffic interception for the authenticated user. No additional exploitation conditions are specified in the advisory.