Siemens IAM Client: 1 CVE, Medium 6.7
Summary
CISA reports 1 vulnerability in Siemens COMOS V10.4.5, COMOS V10.6, Designcenter NX, Simcenter 3D and 12 more. Weakness type: Untrusted Search Path. Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Highest CVSS v3 score: 6.7 (Medium), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Siemens
- Products
- COMOS V10.4.5, COMOS V10.6, Designcenter NX, Simcenter 3D, Simcenter Femap V2506, Simcenter Femap V2512, Simcenter Nastran, Simcenter STAR-CCM+
- CVEs
- CVE-2025-40945
- Highest CVSS v3
- 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Chemical, Critical Manufacturing, Energy
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2025-40945 | Untrusted Search Path | 6.7 | – | No | CVE-2025-40945 |
Affected products (16)
- COMOS V10.4.5 < V10.4.5.0.2
- COMOS V10.6 < V10.6.1
- Designcenter NX < V2512.7000
- Simcenter 3D < V2512.7000
- Simcenter Femap V2506 < V2506.0003
- Simcenter Femap V2512 < V2512.0002
- Simcenter Nastran < V2606
- Simcenter STAR-CCM+ < V2606
- Solid Edge SE2025 < V225.0.13.3
- Solid Edge SE2026 < V226.0.04.003
- Teamcenter Visualization V2412 < V2412.0012
- Teamcenter Visualization V2506 < V2506.0009
- Teamcenter Visualization V2512 < V2512.2605
- Tecnomatix Plant Simulation V2404 < V2404.0022
- Tecnomatix Plant Simulation V2504 < V2504.0010
- Tecnomatix Process Simulate < V2606
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V10.6.1 or later version link
- Vendor Fix: Update to V225.0 Update 13 or later version link
- Vendor Fix: Update to V226.0 Update 04 or later version link
- Vendor Fix: Update to V2404.0022 or later version link
- Vendor Fix: Update to V2412.0012 or later version link
- Vendor Fix: Update to V2504.0010 or later version link
- Vendor Fix: Update to V2506.0003 or later version link
- Vendor Fix: Update to V2506.0009 or later version link
- Vendor Fix: Update to V2512.0002 or later version link
- Vendor Fix: Update to V2512.2605 or later version link
- Vendor Fix: Update to V2512.7000 or later version link
- Vendor Fix: Update to V2606 or later version link
- Vendor Fix: Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-202-05
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-288252.json
- https://cert-portal.siemens.com/productcert/html/ssa-288252.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.