CVE-2025-40745

Siemens Siemens Software Center

MEDIUM 6.3

At a glance

Source: NVD
EPSS: EPSS 0.14 % · percentile 3 (2026-10-28)
State: PUBLISHED
Published: 2026-04-14 08:40 UTC
Updated: 2026-04-14 13:38 UTC
Assigner: siemens
NVD status: Analyzed

Description

A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.

Weaknesses (CWE)

CWE-295 — Improper Certificate Validation

References

https://cert-portal.siemens.com/productcert/html/ssa-981622.html

Scores

Version	Score	Vector	Scored by
CVSS 3.1	LOW 3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	siemens
CVSS 4.0	MEDIUM 6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	siemens
CVSS 4.0	MEDIUM 6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	LOW 3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · productcert@siemens.com (Secondary)

European references

ENISA EUVD · EUVD-2025-209431
GCVE · GCVE-0-2025-40745

Affected configurations (NVD CPE)

cpe:2.3:a:siemens:simcenter_3d:*:*:*:*:*:*:*:* < 2506.6000
cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* < 2506.6000
cpe:2.3:a:siemens:simcenter_star-ccm\+_viewer:*:*:*:*:*:*:*:* < 2602
cpe:2.3:a:siemens:software_center:*:*:*:*:*:*:*:* < 3.5.8.2
cpe:2.3:a:siemens:solid_edge_se2025:*:*:*:*:*:*:*:* < 225.0
cpe:2.3:a:siemens:solid_edge_se2025:225.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0001:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0002:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0003:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0004:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0005:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0006:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0007:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0008:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0009:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0010:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0011:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0012:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2026:*:*:*:*:*:*:*:* < 226.0
cpe:2.3:a:siemens:solid_edge_se2026:226.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_1:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_2:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2026:226.0:update_3:*:*:*:*:*:*
cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* < 2504.0008

Affected products

Product	Versions
Siemens · Siemens Software Center	affected 0 < V3.5.8.2
Siemens · Simcenter 3D	affected 0 < V2506.6000
Siemens · Simcenter Femap	affected 0 < V2506.0002
Siemens · Simcenter STAR-CCM+	affected 0 < V2602
Siemens · Solid Edge SE2025	affected 0 < V225.0 Update 13
Siemens · Solid Edge SE2026	affected 0 < V226.0 Update 04
Siemens · Tecnomatix Plant Simulation	affected 0 < V2504.0008

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD