7.4
High
CVE-2025-40800 A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX…
Description
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| COMOS V10.6 10.6 | earliest → < 10.6.1 | 10.6.1 |
| NX V2412 2412.8700 | earliest → < 2412.8700 | 2412.8700 |
| NX V2506 2506.6000 | earliest → < 2506.6000 | 2506.6000 |
| Simcenter 3D 2506.6000 | earliest → < 2506.6000 | 2506.6000 |
| Simcenter Femap 2506.0002 | earliest → < 2506.0002 | 2506.0002 |
| Solid Edge SE2025 | Versions not published | |
| Solid Edge SE2026 | Versions not published |
References
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com
Timeline
- Published
- Last modified
Other CVEs of COMOS V10.6
The 4 CVEs of COMOS V10.6 →
CVE-2025-40945
A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1),…
6.7
Medium
CVE-2025-40801
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT…
8.1
High
CVE-2024-11053
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used…
3.4
Low