CVE-2025-40945

State: Published
Severity: 8.5 High
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: Apr 16, 2025

Description

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	siemens
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	siemens

Weaknesses

CWE-426 Untrusted Search Path

Affected Products

Product	Versions
COMOS V10.4.5Siemens	before V10.4.5.0.2Affected
COMOS V10.6Siemens	before V10.6.1Affected
Designcenter NXSiemens	before V2512.7000Affected
Simcenter 3DSiemens	before V2512.7000Affected
Simcenter Femap V2506Siemens	before V2506.0003Affected
Simcenter Femap V2512Siemens	before V2512.0002Affected
Simcenter NastranSiemens	before V2606Affected
Simcenter STAR-CCM+Siemens	before V2606Affected
Solid Edge SE2025Siemens	before V225.0 Update 13Affected
Solid Edge SE2026Siemens	before V226.0 Update 04Affected
Teamcenter Visualization V2412Siemens	before V2412.0012Affected
Teamcenter Visualization V2506Siemens	before V2506.0009Affected
Teamcenter Visualization V2512Siemens	before V2512.2605Affected
Tecnomatix Plant Simulation V2404Siemens	before V2404.0022Affected
Tecnomatix Plant Simulation V2504Siemens	before V2504.0010Affected
Tecnomatix Process SimulateSiemens	before V2606Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-288252.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.