CVE-2025-40945

mediumpriority · track · 0EPSS 0.002 · 6 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.16% (6th) EPSS

CVSS 6.7 · medium

Is it mine?

258 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCOMOS V10.4.5siemens_psirt
Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information
FixedCOMOS V10.6siemens_psirt
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/
FixedDesigncenter NXsiemens_psirt
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/209349590/
FixedSimcenter 3Dsiemens_psirt
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/289054037/
FixedSimcenter Femap V2506siemens_psirt
Update to V2506.0003 or later version
https://support.sw.siemens.com/product/275652363/
FixedSimcenter Femap V2512siemens_psirt
Update to V2512.0002 or later version
https://support.sw.siemens.com/product/275652363/
FixedSimcenter Nastransiemens_psirt
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/
FixedSimcenter STAR-CCM+siemens_psirt
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/
FixedSolid Edge SE2025siemens_psirt
Update to V225.0 Update 13 or later version
https://support.sw.siemens.com/product/246738425/
FixedSolid Edge SE2026siemens_psirt
Update to V226.0 Update 04 or later version
https://support.sw.siemens.com/product/246738425/
FixedTeamcenter Visualization V2412siemens_psirt
Update to V2412.0012 or later version
https://support.sw.siemens.com/product/229029598/
FixedTeamcenter Visualization V2506siemens_psirt
Update to V2506.0009 or later version
https://support.sw.siemens.com/product/229029598/
FixedTeamcenter Visualization V2512siemens_psirt
Update to V2512.2605 or later version
https://support.sw.siemens.com/product/229029598/
FixedTecnomatix Plant Simulation V2404siemens_psirt
Update to V2404.0022 or later version
https://support.sw.siemens.com/product/297028302/
FixedTecnomatix Plant Simulation V2504siemens_psirt
Update to V2504.0010 or later version
https://support.sw.siemens.com/product/297028302/
FixedTecnomatix Process Simulatesiemens_psirt
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/
FixedCOMOS V10.4.5cisa_csaf_ot
Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information
FixedCOMOS V10.6cisa_csaf_ot
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/
FixedDesigncenter NXcisa_csaf_ot
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/209349590/
FixedSimcenter 3Dcisa_csaf_ot
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/289054037/
FixedSimcenter Femap V2506cisa_csaf_ot
Update to V2506.0003 or later version
https://support.sw.siemens.com/product/275652363/
FixedSimcenter Femap V2512cisa_csaf_ot
Update to V2512.0002 or later version
https://support.sw.siemens.com/product/275652363/
FixedSimcenter Nastrancisa_csaf_ot
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/
FixedSimcenter STAR-CCM+cisa_csaf_ot
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/
FixedSolid Edge SE2025cisa_csaf_ot
Update to V225.0 Update 13 or later version
https://support.sw.siemens.com/product/246738425/
FixedSolid Edge SE2026cisa_csaf_ot
Update to V226.0 Update 04 or later version
https://support.sw.siemens.com/product/246738425/
FixedTeamcenter Visualization V2412cisa_csaf_ot
Update to V2412.0012 or later version
https://support.sw.siemens.com/product/229029598/
FixedTeamcenter Visualization V2506cisa_csaf_ot
Update to V2506.0009 or later version
https://support.sw.siemens.com/product/229029598/
FixedTeamcenter Visualization V2512cisa_csaf_ot
Update to V2512.2605 or later version
https://support.sw.siemens.com/product/229029598/
FixedTecnomatix Plant Simulation V2404cisa_csaf_ot
Update to V2404.0022 or later version
https://support.sw.siemens.com/product/297028302/
FixedTecnomatix Plant Simulation V2504cisa_csaf_ot
Update to V2504.0010 or later version
https://support.sw.siemens.com/product/297028302/
FixedTecnomatix Process Simulatecisa_csaf_ot
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/

cvss

Technical severity, 0–10. One row per scoring source.

8.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.5

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · productcert@siemens.com DEexploitability 0.8 · impact 5.9

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v4.08.5highCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.5highCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.05.9mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-426USCWE-426USCWE-426USCWE-426USCWE-426US

affected products (258)

Products and version ranges known to be affected.

COMOS V10.4.5 < V10.4.5.0.2all versionscisa_csaf_otUS
COMOS V10.6 < V10.6.1all versionscisa_csaf_otUS
Designcenter NX < V2512.7000all versionscisa_csaf_otUS
Simcenter 3D < V2512.7000all versionscisa_csaf_otUS
Simcenter Femap V2506 < V2506.0003all versionscisa_csaf_otUS
Simcenter Femap V2512 < V2512.0002all versionscisa_csaf_otUS
Simcenter Nastran < V2606all versionscisa_csaf_otUS
Simcenter STAR-CCM+ < V2606all versionscisa_csaf_otUS
Solid Edge SE2025 < V225.0.13.3all versionscisa_csaf_otUS
Solid Edge SE2026 < V226.0.04.003all versionscisa_csaf_otUS
Teamcenter Visualization V2412 < V2412.0012all versionscisa_csaf_otUS
Teamcenter Visualization V2506 < V2506.0009all versionscisa_csaf_otUS
Teamcenter Visualization V2512 < V2512.2605all versionscisa_csaf_otUS
Tecnomatix Plant Simulation V2404 < V2404.0022all versionscisa_csaf_otUS
Tecnomatix Plant Simulation V2504 < V2504.0010all versionscisa_csaf_otUS
Tecnomatix Process Simulate < V2606all versionscisa_csaf_otUS
Siemens COMOS V10.4.5≤ vers:intdot/<10.4.5.0.2cisa_csaf_otUS
Siemens COMOS V10.6≤ vers:intdot/<10.6.1cisa_csaf_otUS
Siemens Designcenter NX≤ vers:intdot/<2512.7000cisa_csaf_otUS
Siemens Simcenter 3D≤ vers:intdot/<2512.7000cisa_csaf_otUS

showing 20 of 258

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0229Kwetsbaarheden verholpen in Siemens productenNL2026-07-14csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als CADRA, IAM, Mendix, OpCenter, RUGGEDCOM, SIDIS en SIMATIC.
SSA-288252SSA-288252: Unquoted Search Path Vulnerability in IAM Client2026-07-14csaf · siemens_psirtDE
Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
ICSA-26-202-05Siemens IAM Client2026-07-14icsa · cisa_csaf_otUS
Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2026-07-14modified 2026-07-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan