ICSA-25-345-05

Siemens Advanced Licensing (SALT) Toolkit

view advisory published 2025-12-09

Multiple Siemens products are affected by improper certificate validation in Siemens Advanced Licensing (SALT) Toolkit. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-40801US	—	0.26% (18th)	—	2025-12-09
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (A…

references

External citations — patches, advisories, analysis.

remediations (9)

No fix plannedJT Bi-Directional Translator for STEP
Currently no fix is planned
FixedCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/
FixedNX V2412
Update to V2412.8900 or later version
https://support.sw.siemens.com/product/209349590/
FixedNX V2506
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/209349590/
FixedSimcenter 3D
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/289054037/
FixedSimcenter Femap
Update to V2506.0002 or later version
https://support.sw.siemens.com/product/275652363/
FixedSimcenter Studio
Update to V2506.0001 or later version
FixedSimcenter System Architect
Update to V2506.0001 or later version
https://support.sw.siemens.com/product/273211926/
FixedTecnomatix Plant Simulation
Update to V2504.0007 or later version
https://support.sw.siemens.com/product/297028302/

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan