CVE-2025-40945
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Siemens | COMOS V10.4.5 | 0 < V10.4.5.0.2 | affected |
| Siemens | COMOS V10.6 | 0 < V10.6.1 | affected |
| Siemens | Designcenter NX | 0 < V2512.7000 | affected |
| Siemens | Simcenter 3D | 0 < V2512.7000 | affected |
| Siemens | Simcenter Femap V2506 | 0 < V2506.0003 | affected |
| Siemens | Simcenter Femap V2512 | 0 < V2512.0002 | affected |
| Siemens | Simcenter Nastran | 0 < V2606 | affected |
| Siemens | Simcenter STAR-CCM+ | 0 < V2606 | affected |
| Siemens | Solid Edge SE2025 | 0 < V225.0 Update 13 | affected |
| Siemens | Solid Edge SE2026 | 0 < V226.0 Update 04 | affected |
| Siemens | Teamcenter Visualization V2412 | 0 < V2412.0012 | affected |
| Siemens | Teamcenter Visualization V2506 | 0 < V2506.0009 | affected |
| Siemens | Teamcenter Visualization V2512 | 0 < V2512.2605 | affected |
| Siemens | Tecnomatix Plant Simulation V2404 | 0 < V2404.0022 | affected |
| Siemens | Tecnomatix Plant Simulation V2504 | 0 < V2504.0010 | affected |
| Siemens | Tecnomatix Process Simulate | 0 < V2606 | affected |
Weaknesses
- CWE-426: CWE-426: Untrusted Search Path
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.