Read the docs
TI-2025-27247 Aliases CVE-2025-40800GHSA-xg9v-jc69-p54f

Improper certificate validation in Siemens COMOS V10.6

Priority MEDIUM 41CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed COMOS V10.6 (Siemens): V10.6.1NX V2412 (Siemens): V2412.8700+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCOMOS V10.6before V10.6.1V10.6.1Patch availableCNA
SiemensCOMOS V10.6before V10.6.1V10.6.1Patch availableCNA
SiemensNX V2412before V2412.8700V2412.8700Patch availableCNA
SiemensNX V2506before V2506.6000V2506.6000Patch availableCNA
SiemensSimcenter 3Dbefore V2506.6000V2506.6000Patch availableCNA
SiemensSimcenter Femapbefore V2506.0002V2506.0002Patch availableCNA
SiemensSolid Edge SE2025before V225.0 Update 10V225.0 Update 10Patch availableCNA
SiemensSolid Edge SE2026before V226.0 Update 1V226.0 Update 1Patch availableCNA
  • COMOS V10.6 VendorSiemens Affected before V10.6.1 Fixed in V10.6.1 Patch available CNA
  • COMOS V10.6 VendorSiemens Affected before V10.6.1 Fixed in V10.6.1 Patch available CNA
  • NX V2412 VendorSiemens Affected before V2412.8700 Fixed in V2412.8700 Patch available CNA
  • NX V2506 VendorSiemens Affected before V2506.6000 Fixed in V2506.6000 Patch available CNA
  • Simcenter 3D VendorSiemens Affected before V2506.6000 Fixed in V2506.6000 Patch available CNA
  • Simcenter Femap VendorSiemens Affected before V2506.0002 Fixed in V2506.0002 Patch available CNA
  • Solid Edge SE2025 VendorSiemens Affected before V225.0 Update 10 Fixed in V225.0 Update 10 Patch available CNA
  • Solid Edge SE2026 VendorSiemens Affected before V226.0 Update 1 Fixed in V226.0 Update 1 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA COMOS V10.6 (Siemens) Fixed in V10.6.1
  • Fix · CNA COMOS V10.6 (Siemens) Fixed in V10.6.1
  • Fix · CNA NX V2412 (Siemens) Fixed in V2412.8700
  • Fix · CNA NX V2506 (Siemens) Fixed in V2506.6000
  • Fix · CNA Simcenter 3D (Siemens) Fixed in V2506.6000
  • Fix · CNA Simcenter Femap (Siemens) Fixed in V2506.0002
  • Fix · CNA Solid Edge SE2025 (Siemens) Fixed in V225.0 Update 10
  • Fix · CNA Solid Edge SE2026 (Siemens) Fixed in V226.0 Update 1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens COMOS V10.6, NX V2506 and 2 more products V10.6.1, V2506.0002, V2506.6000

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-27248 Improper certificate validation in Siemens COMOS V10.6Priority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40800
  2. 2026-10-03 Alias added: GHSA-xg9v-jc69-p54f

References

Other 2

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences