CVE-2025-40745

State: Published
Severity: 6.3 Medium
Published: Apr 14, 2026
Updated: Apr 14, 2026
Reserved: Apr 16, 2025

Description

A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	siemens
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	siemens

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
Siemens Software CenterSiemens	before V3.5.8.2Affected
Simcenter 3DSiemens	before V2506.6000Affected
Simcenter FemapSiemens	before V2506.0002Affected
Simcenter STAR-CCM+Siemens	before V2602Affected
Solid Edge SE2025Siemens	before V225.0 Update 13Affected
Solid Edge SE2026Siemens	before V226.0 Update 04Affected
Tecnomatix Plant SimulationSiemens	before V2504.0008Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-981622.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.