CVE-2025-40945: A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions <…

PriorityP432medium6.7CVSS 3.1

AVLACLPRHUINSUCHIHAH

EPSS

0.14%

4.0th percentile

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
siemens	comos_v10.4.5	< V10.4.5.0.2	V10.4.5.0.2
siemens	comos_v10.6	< V10.6.1	V10.6.1
siemens	designcenter_nx	< V2512.7000	V2512.7000
siemens	simcenter_3d	< V2512.7000	V2512.7000
siemens	simcenter_femap_v2506	< V2506.0003	V2506.0003
siemens	simcenter_femap_v2512	< V2512.0002	V2512.0002
siemens	simcenter_nastran	< V2606	V2606
siemens	simcenter_star-ccm	< V2606	V2606
siemens	solid_edge_se2025	< V225.0 Update 13	V225.0 Update 13
siemens	solid_edge_se2026	< V226.0 Update 04	V226.0 Update 04
siemens	teamcenter_visualization_v2412	< V2412.0012	V2412.0012
siemens	teamcenter_visualization_v2506	< V2506.0009	V2506.0009
siemens	teamcenter_visualization_v2512	< V2512.2605	V2512.2605
siemens	tecnomatix_plant_simulation_v2404	< V2404.0022	V2404.0022
siemens	tecnomatix_plant_simulation_v2504	< V2504.0010	V2504.0010
siemens	tecnomatix_process_simulate	< V2606	V2606

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.5HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.