ICSA-25-345-04

Siemens IAM Client

Advisory ansehen veröffentlicht 2025-12-09

Multiple Siemens products are affected by improper certificate validation in IAM Client. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-40800US	—	0.21% (11th)	—	2025-12-09
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

Behebungen (7)

BehobenCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/
BehobenNX V2412
Update to V2412.8700 or later version
https://support.sw.siemens.com/product/209349590/
BehobenNX V2506
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/209349590/
BehobenSimcenter 3D
Update to V2506.6000 or later version
https://support.sw.siemens.com/product/289054037/
BehobenSimcenter Femap
Update to V2506.0002 or later version
https://support.sw.siemens.com/product/275652363/
BehobenSolid Edge SE2025
Update to V225.0 Update 10 or later version
https://support.sw.siemens.com/product/246738425/
BehobenSolid Edge SE2026
Update to V226.0 Update 1 or later version
https://support.sw.siemens.com/product/246738425/

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan