Read the docs
TI-2025-27336 Aliases CVE-2025-40945GHSA-fh68-jj27-gphg

Untrusted search path in Siemens COMOS V10.4.5

Priority LOW 38CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed COMOS V10.4.5 (Siemens): V10.4.5.0.2COMOS V10.6 (Siemens): V10.6.1+14 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCOMOS V10.4.5before V10.4.5.0.2V10.4.5.0.2Patch availableCNA
SiemensCOMOS V10.6before V10.6.1V10.6.1Patch availableCNA
SiemensDesigncenter NXbefore V2512.7000V2512.7000Patch availableCNA
SiemensSimcenter 3Dbefore V2512.7000V2512.7000Patch availableCNA
SiemensSimcenter Femap V2506before V2506.0003V2506.0003Patch availableCNA
SiemensSimcenter Femap V2512before V2512.0002V2512.0002Patch availableCNA
SiemensSimcenter Nastranbefore V2606V2606Patch availableCNA
SiemensSimcenter STAR-CCM+before V2606V2606Patch availableCNA
SiemensSolid Edge SE2025before V225.0 Update 13V225.0 Update 13Patch availableCNA
SiemensSolid Edge SE2026before V226.0 Update 04V226.0 Update 04Patch availableCNA
SiemensTeamcenter Visualization V2412before V2412.0012V2412.0012Patch availableCNA
SiemensTeamcenter Visualization V2506before V2506.0009V2506.0009Patch availableCNA
SiemensTeamcenter Visualization V2512before V2512.2605V2512.2605Patch availableCNA
SiemensTecnomatix Plant Simulation V2404before V2404.0022V2404.0022Patch availableCNA
SiemensTecnomatix Plant Simulation V2504before V2504.0010V2504.0010Patch availableCNA
SiemensTecnomatix Process Simulatebefore V2606V2606Patch availableCNA
  • COMOS V10.4.5 VendorSiemens Affected before V10.4.5.0.2 Fixed in V10.4.5.0.2 Patch available CNA
  • COMOS V10.6 VendorSiemens Affected before V10.6.1 Fixed in V10.6.1 Patch available CNA
  • Designcenter NX VendorSiemens Affected before V2512.7000 Fixed in V2512.7000 Patch available CNA
  • Simcenter 3D VendorSiemens Affected before V2512.7000 Fixed in V2512.7000 Patch available CNA
  • Simcenter Femap V2506 VendorSiemens Affected before V2506.0003 Fixed in V2506.0003 Patch available CNA
  • Simcenter Femap V2512 VendorSiemens Affected before V2512.0002 Fixed in V2512.0002 Patch available CNA
  • Simcenter Nastran VendorSiemens Affected before V2606 Fixed in V2606 Patch available CNA
  • Simcenter STAR-CCM+ VendorSiemens Affected before V2606 Fixed in V2606 Patch available CNA
  • Solid Edge SE2025 VendorSiemens Affected before V225.0 Update 13 Fixed in V225.0 Update 13 Patch available CNA
  • Solid Edge SE2026 VendorSiemens Affected before V226.0 Update 04 Fixed in V226.0 Update 04 Patch available CNA
  • Teamcenter Visualization V2412 VendorSiemens Affected before V2412.0012 Fixed in V2412.0012 Patch available CNA
  • Teamcenter Visualization V2506 VendorSiemens Affected before V2506.0009 Fixed in V2506.0009 Patch available CNA
  • Teamcenter Visualization V2512 VendorSiemens Affected before V2512.2605 Fixed in V2512.2605 Patch available CNA
  • Tecnomatix Plant Simulation V2404 VendorSiemens Affected before V2404.0022 Fixed in V2404.0022 Patch available CNA
  • Tecnomatix Plant Simulation V2504 VendorSiemens Affected before V2504.0010 Fixed in V2504.0010 Patch available CNA
  • Tecnomatix Process Simulate VendorSiemens Affected before V2606 Fixed in V2606 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA COMOS V10.4.5 (Siemens) Fixed in V10.4.5.0.2
  • Fix · CNA COMOS V10.6 (Siemens) Fixed in V10.6.1
  • Fix · CNA Designcenter NX (Siemens) Fixed in V2512.7000
  • Fix · CNA Simcenter 3D (Siemens) Fixed in V2512.7000
  • Fix · CNA Simcenter Femap V2506 (Siemens) Fixed in V2506.0003
  • Fix · CNA Simcenter Femap V2512 (Siemens) Fixed in V2512.0002
  • Fix · CNA Simcenter Nastran (Siemens) Fixed in V2606
  • Fix · CNA Simcenter STAR-CCM+ (Siemens) Fixed in V2606
  • Fix · CNA Solid Edge SE2025 (Siemens) Fixed in V225.0 Update 13
  • Fix · CNA Solid Edge SE2026 (Siemens) Fixed in V226.0 Update 04
  • Fix · CNA Teamcenter Visualization V2412 (Siemens) Fixed in V2412.0012
  • Fix · CNA Teamcenter Visualization V2506 (Siemens) Fixed in V2506.0009
  • Fix · CNA Teamcenter Visualization V2512 (Siemens) Fixed in V2512.2605
  • Fix · CNA Tecnomatix Plant Simulation V2404 (Siemens) Fixed in V2404.0022
  • Fix · CNA Tecnomatix Plant Simulation V2504 (Siemens) Fixed in V2504.0010
  • Fix · CNA Tecnomatix Process Simulate (Siemens) Fixed in V2606

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40945
  2. 2026-10-03 Alias added: GHSA-fh68-jj27-gphg

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences