Read the docs
TI-2025-27248 Aliases CVE-2025-40801GHSA-3p2p-55rm-xcvw

Improper certificate validation in Siemens COMOS V10.6

Priority MEDIUM 41CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions < V2506.0001), Simcenter System Architect (All versions < V2506.0001), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00263 18th percentileScored 2026-11-07
Fix Fixed COMOS V10.6 (Siemens): V10.6.1NX V2412 (Siemens): V2412.8900+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCOMOS V10.6before V10.6.1V10.6.1Patch availableCNA
SiemensCOMOS V10.6before V10.6.1V10.6.1Patch availableCNA
SiemensJT Bi-Directional Translator for STEPall versions—No fix listedCNA
SiemensNX V2412before V2412.8900V2412.8900Patch availableCNA
SiemensNX V2506before V2506.6000V2506.6000Patch availableCNA
SiemensSimcenter 3Dbefore V2506.6000V2506.6000Patch availableCNA
SiemensSimcenter Femapbefore V2506.0002V2506.0002Patch availableCNA
SiemensSimcenter Studiobefore V2506.0001V2506.0001Patch availableCNA
SiemensSimcenter System Architectbefore V2506.0001V2506.0001Patch availableCNA
SiemensTecnomatix Plant Simulationbefore V2504.0007V2504.0007Patch availableCNA
  • COMOS V10.6 VendorSiemens Affected before V10.6.1 Fixed in V10.6.1 Patch available CNA
  • COMOS V10.6 VendorSiemens Affected before V10.6.1 Fixed in V10.6.1 Patch available CNA
  • JT Bi-Directional Translator for STEP VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • NX V2412 VendorSiemens Affected before V2412.8900 Fixed in V2412.8900 Patch available CNA
  • NX V2506 VendorSiemens Affected before V2506.6000 Fixed in V2506.6000 Patch available CNA
  • Simcenter 3D VendorSiemens Affected before V2506.6000 Fixed in V2506.6000 Patch available CNA
  • Simcenter Femap VendorSiemens Affected before V2506.0002 Fixed in V2506.0002 Patch available CNA
  • Simcenter Studio VendorSiemens Affected before V2506.0001 Fixed in V2506.0001 Patch available CNA
  • Simcenter System Architect VendorSiemens Affected before V2506.0001 Fixed in V2506.0001 Patch available CNA
  • Tecnomatix Plant Simulation VendorSiemens Affected before V2504.0007 Fixed in V2504.0007 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA COMOS V10.6 (Siemens) Fixed in V10.6.1
  • Fix · CNA COMOS V10.6 (Siemens) Fixed in V10.6.1
  • Fix · CNA NX V2412 (Siemens) Fixed in V2412.8900
  • Fix · CNA NX V2506 (Siemens) Fixed in V2506.6000
  • Fix · CNA Simcenter 3D (Siemens) Fixed in V2506.6000
  • Fix · CNA Simcenter Femap (Siemens) Fixed in V2506.0002
  • Fix · CNA Simcenter Studio (Siemens) Fixed in V2506.0001
  • Fix · CNA Simcenter System Architect (Siemens) Fixed in V2506.0001
  • Fix · CNA Tecnomatix Plant Simulation (Siemens) Fixed in V2504.0007

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens COMOS V10.6, NX V2506 and 2 more products V10.6.1, V2506.0002, V2506.6000

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-27247 Improper certificate validation in Siemens COMOS V10.6Priority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40801
  2. 2026-10-03 Alias added: GHSA-3p2p-55rm-xcvw

References

Other 2

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences