Improper certificate validation in Siemens Software Center
Priority LOW 27CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.
Summary
A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00137 3rd percentileScored 2026-11-07
Fix Fixed Siemens Software Center (Siemens): V3.5.8.2Simcenter 3D (Siemens): V2506.6000+5 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Siemens Software Center | before V3.5.8.2 | V3.5.8.2 | Patch available | CNA |
| Siemens | Simcenter 3D | before V2506.6000 | V2506.6000 | Patch available | CNA |
| Siemens | Simcenter Femap | before V2506.0002 | V2506.0002 | Patch available | CNA |
| Siemens | Simcenter STAR-CCM+ | before V2602 | V2602 | Patch available | CNA |
| Siemens | Solid Edge SE2025 | before V225.0 Update 13 | V225.0 Update 13 | Patch available | CNA |
| Siemens | Solid Edge SE2026 | before V226.0 Update 04 | V226.0 Update 04 | Patch available | CNA |
| Siemens | Tecnomatix Plant Simulation | before V2504.0008 | V2504.0008 | Patch available | CNA |
- Siemens Software Center VendorSiemens Affected before V3.5.8.2 Fixed in V3.5.8.2 Patch available CNA
- Simcenter 3D VendorSiemens Affected before V2506.6000 Fixed in V2506.6000 Patch available CNA
- Simcenter Femap VendorSiemens Affected before V2506.0002 Fixed in V2506.0002 Patch available CNA
- Simcenter STAR-CCM+ VendorSiemens Affected before V2602 Fixed in V2602 Patch available CNA
- Solid Edge SE2025 VendorSiemens Affected before V225.0 Update 13 Fixed in V225.0 Update 13 Patch available CNA
- Solid Edge SE2026 VendorSiemens Affected before V226.0 Update 04 Fixed in V226.0 Update 04 Patch available CNA
- Tecnomatix Plant Simulation VendorSiemens Affected before V2504.0008 Fixed in V2504.0008 Patch available CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:simcenter_3d:*:*:*:*:*:*:*:* | before 2506.6000 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* | before 2506.6000 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simcenter_star-ccm\+_viewer:*:*:*:*:*:*:*:* | before 2602 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:software_center:*:*:*:*:*:*:*:* | before 3.5.8.2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:*:*:*:*:*:*:*:* | before 225.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:-:*:*:*:*:*:* | 225.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0001:*:*:*:*:*:* | 225.0 update_0001 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0002:*:*:*:*:*:* | 225.0 update_0002 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0003:*:*:*:*:*:* | 225.0 update_0003 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0004:*:*:*:*:*:* | 225.0 update_0004 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:simcenter_3d:*:*:*:*:*:*:*:* Versions before 2506.6000 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* Versions before 2506.6000 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simcenter_star-ccm\+_viewer:*:*:*:*:*:*:*:* Versions before 2602 Vulnerable ·Siemens
- cpe:2.3:a:siemens:software_center:*:*:*:*:*:*:*:* Versions before 3.5.8.2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:*:*:*:*:*:*:*:* Versions before 225.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:-:*:*:*:*:*:* Versions 225.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0001:*:*:*:*:*:* Versions 225.0 update_0001 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0002:*:*:*:*:*:* Versions 225.0 update_0002 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0003:*:*:*:*:*:* Versions 225.0 update_0003 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0004:*:*:*:*:*:* Versions 225.0 update_0004 Vulnerable ·Siemens
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0005:*:*:*:*:*:* | 225.0 update_0005 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0006:*:*:*:*:*:* | 225.0 update_0006 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0007:*:*:*:*:*:* | 225.0 update_0007 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0008:*:*:*:*:*:* | 225.0 update_0008 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0009:*:*:*:*:*:* | 225.0 update_0009 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0010:*:*:*:*:*:* | 225.0 update_0010 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0011:*:*:*:*:*:* | 225.0 update_0011 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0012:*:*:*:*:*:* | 225.0 update_0012 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2026:*:*:*:*:*:*:*:* | before 226.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2026:226.0:-:*:*:*:*:*:* | 226.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_1:*:*:*:*:*:* | 226.0 update_1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_2:*:*:*:*:*:* | 226.0 update_2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_3:*:*:*:*:*:* | 226.0 update_3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* | before 2504.0008 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0005:*:*:*:*:*:* Versions 225.0 update_0005 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0006:*:*:*:*:*:* Versions 225.0 update_0006 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0007:*:*:*:*:*:* Versions 225.0 update_0007 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0008:*:*:*:*:*:* Versions 225.0 update_0008 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0009:*:*:*:*:*:* Versions 225.0 update_0009 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0010:*:*:*:*:*:* Versions 225.0 update_0010 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0011:*:*:*:*:*:* Versions 225.0 update_0011 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0012:*:*:*:*:*:* Versions 225.0 update_0012 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2026:*:*:*:*:*:*:*:* Versions before 226.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2026:226.0:-:*:*:*:*:*:* Versions 226.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_1:*:*:*:*:*:* Versions 226.0 update_1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_2:*:*:*:*:*:* Versions 226.0 update_2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_3:*:*:*:*:*:* Versions 226.0 update_3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* Versions before 2504.0008 Vulnerable ·Siemens
Remediation
- Fix · CNA Siemens Software Center (Siemens) Fixed in V3.5.8.2
- Fix · CNA Simcenter 3D (Siemens) Fixed in V2506.6000
- Fix · CNA Simcenter Femap (Siemens) Fixed in V2506.0002
- Fix · CNA Simcenter STAR-CCM+ (Siemens) Fixed in V2602
- Fix · CNA Solid Edge SE2025 (Siemens) Fixed in V225.0 Update 13
- Fix · CNA Solid Edge SE2026 (Siemens) Fixed in V226.0 Update 04
- Fix · CNA Tecnomatix Plant Simulation (Siemens) Fixed in V2504.0008
Timeline
- 2026-10-02 Threatist record created from CVE-2025-40745
- 2026-10-03 Alias added: GHSA-vv4w-99g8-93pp
References
Sources
- CVE-2025-40745 · CVE Program
- CVE-2025-40745 · NVD
- FIRST EPSS
- GHSA-vv4w-99g8-93pp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences