CVE-2025-40800
Description
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
How to fix
- Siemens COMOS V10.6V10.6.1 or later
- Siemens NX V2412V2412.8700 or later
- Siemens NX V2506V2506.6000 or later
- Siemens Simcenter 3DV2506.6000 or later
- Siemens Simcenter FemapV2506.0002 or later
- Siemens Solid Edge SE2025V225.0 Update 10 or later
- Siemens Solid Edge SE2026V226.0 Update 1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens COMOS V10.6 | v < V10.6.1 | V10.6.1 |
| Siemens NX V2412 | v < V2412.8700 | V2412.8700 |
| Siemens NX V2506 | v < V2506.6000 | V2506.6000 |
| Siemens Simcenter 3D | v < V2506.6000 | V2506.6000 |
| Siemens Simcenter Femap | v < V2506.0002 | V2506.0002 |
| Siemens Solid Edge SE2025 | v < V225.0 Update 10 | V225.0 Update 10 |
| Siemens Solid Edge SE2026 | v < V226.0 Update 1 | V226.0 Update 1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.