CVE-2025-40800
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
- Score
- CVSS 4.0 9.1 Critical
- Status
- Deferred - productcert@siemens.com
- Published
- 2025-12-09
- Last modified
- 2026-10-07
- Weaknesses
- CWE-295
Affected products
- Comos V10.6 (Siemens)
- Nx V2412 (Siemens)
- Nx V2506 (Siemens)
- Simcenter 3d (Siemens)
- Simcenter Femap (Siemens)
- Solid Edge Se2025 (Siemens)
- Solid Edge Se2026 (Siemens)
References
- https://cert-portal.siemens.com/productcert/html/ssa-868571.html
- https://cert-portal.siemens.com/productcert/html/ssa-212953.html
