CVE-2025-40945

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-05
Weakness: CWE-426

Description

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

Affected products

Siemens COMOS V10.4.5: before V10.4.5.0.2 — fixed in V10.4.5.0.2
Siemens COMOS V10.6: before V10.6.1 — fixed in V10.6.1
Siemens Designcenter NX: before V2512.7000 — fixed in V2512.7000
Siemens Simcenter 3D: before V2512.7000 — fixed in V2512.7000
Siemens Simcenter Femap V2506: before V2506.0003 — fixed in V2506.0003
Siemens Simcenter Femap V2512: before V2512.0002 — fixed in V2512.0002
Siemens Simcenter Nastran: before V2606 — fixed in V2606
Siemens Simcenter STAR-CCM+: before V2606 — fixed in V2606
Siemens Solid Edge SE2021: before V225.0 Update 13 — fixed in V225.0 Update 13
Siemens Solid Edge SE2026: before V226.0 Update 04 — fixed in V226.0 Update 04
Siemens Teamcenter Visualization V2412: before V2412.0012 — fixed in V2412.0012
Siemens Teamcenter Visualization V2506: before V2506.0009 — fixed in V2506.0009
Siemens Teamcenter Visualization V2512: before V2512.2605 — fixed in V2512.2605
Siemens Tecnomatix Plant Simulation V2404: before V2404.0022 — fixed in V2404.0022
Siemens Tecnomatix Plant Simulation V2504: before V2504.0010 — fixed in V2504.0010
Siemens Tecnomatix Process Simulate: before V2606 — fixed in V2606

How to fix

Upgrade to a fixed version: Siemens COMOS V10.4.5 V10.4.5.0.2; Siemens COMOS V10.6 V10.6.1; Siemens Designcenter NX V2512.7000; Siemens Simcenter 3D V2512.7000; Siemens Simcenter Femap V2506 V2506.0003; Siemens Simcenter Femap V2512 V2512.0002; Siemens Simcenter Nastran V2606; Siemens Simcenter STAR-CCM+ V2606; Siemens Solid Edge SE2021 V225.0 Update 13; Siemens Solid Edge SE2026 V226.0 Update 04; Siemens Teamcenter Visualization V2412 V2412.0012; Siemens Teamcenter Visualization V2506 V2506.0009. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-288252.html

Get alerted when CVE-2025-40945 or the next vulnerability affects your stack