Siemens IAM Client
Multiple Siemens products are affected by improper certificate validation in IAM Client. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-40800US | — | — | ||
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2… | ||||
references
External citations — patches, advisories, analysis.
- SSA-868571: Missing Server Certificate Validation in IAM Client - CSAF Versionself
- SSA-868571: Missing Server Certificate Validation in IAM Client - HTML Versionself
- ICS Advisory ICSA-25-345-04 JSONself
- ICS Advisory ICSA-25-345-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (7)
- FixedCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/ - FixedNX V2412
Update to V2412.8700 or later version
https://support.sw.siemens.com/product/209349590/ - FixedNX V2506
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/209349590/ - FixedSimcenter 3D
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/289054037/ - FixedSimcenter Femap
Update to V2506.0002 or later version
https://support.sw.siemens.com/product/275652363/ - FixedSolid Edge SE2025
Update to V225.0 Update 10 or later version
https://support.sw.siemens.com/product/246738425/ - FixedSolid Edge SE2026
Update to V226.0 Update 1 or later version
https://support.sw.siemens.com/product/246738425/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan