CVE-2025-40945A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V251…
Updated under an hour ago ()
Does this affect you?
It affects Siemens COMOS V10.4.5 and 15 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.
- CVSS
- 6.7 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-426
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- siemens
- NVD analysis
- Deferred
- Record last updated
- Jul 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Siemens COMOS V10.4.5 siemens:comos_v10.4.5 (from the name) | before V10.4.5.0.2 | CNA record |
Siemens COMOS V10.6 siemens:comos_v10.6 (from the name) | before V10.6.1 | CNA record |
Siemens Designcenter NX siemens:designcenter_nx (from the name) | before V2512.7000 | CNA record |
Siemens Simcenter 3D siemens:simcenter_3d (from the name) | before V2512.7000 | CNA record |
Siemens Simcenter Femap V2506 siemens:simcenter_femap_v2506 (from the name) | before V2506.0003 | CNA record |
Siemens Simcenter Femap V2512 siemens:simcenter_femap_v2512 (from the name) | before V2512.0002 | CNA record |
Siemens Simcenter Nastran siemens:simcenter_nastran (from the name) | before V2606 | CNA record |
Siemens Simcenter STAR-CCM+ siemens:simcenter_star_ccm+ (from the name) | before V2606 | CNA record |
Siemens Solid Edge SE2025 siemens:solid_edge_se2025 (from the name) | before V225.0 Update 13 | CNA record |
Siemens Solid Edge SE2026 siemens:solid_edge_se2026 (from the name) | before V226.0 Update 04 | CNA record |
Siemens Teamcenter Visualization V2412 siemens:teamcenter_visualization_v2412 (from the name) | before V2412.0012 | CNA record |
Siemens Teamcenter Visualization V2506 siemens:teamcenter_visualization_v2506 (from the name) | before V2506.0009 | CNA record |
Siemens Teamcenter Visualization V2512 siemens:teamcenter_visualization_v2512 (from the name) | before V2512.2605 | CNA record |
Siemens Tecnomatix Plant Simulation V2404 siemens:tecnomatix_plant_simulation_v2404 (from the name) | before V2404.0022 | CNA record |
Siemens Tecnomatix Plant Simulation V2504 siemens:tecnomatix_plant_simulation_v2504 (from the name) | before V2504.0010 | CNA record |
Siemens Tecnomatix Process Simulate siemens:tecnomatix_process_simulate (from the name) | before V2606 | CNA record |
References
- https://cert-portal.siemens.com/productcert/html/ssa-288252.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.