CVE-2025-40800

HighCVSS 7.4/10Last modified Oct 7, 2026

Description

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
SiemensCOMOS V10.6< V10.6.1
SiemensCOMOS V10.6< V10.6.1
SiemensNX V2412< V2412.8700
SiemensNX V2506< V2506.6000
SiemensSimcenter 3D< V2506.6000
SiemensSimcenter Femap< V2506.0002
SiemensSolid Edge SE2025< V225.0 Update 10
SiemensSolid Edge SE2026< V226.0 Update 1

References

Timeline

Published
Dec 9, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-408018.1A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional TranslaCVE-2025-408024.3A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resourceCVE-2025-408033.1A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical iCVE-2025-408049.1A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a netwoCVE-2025-4080510.0Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attaCVE-2025-408065.3A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeratioCVE-2025-408075.4A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay CVE-2025-408086.1A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CCVE-2025-408097.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update CVE-2025-40814.8Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute aCVE-2025-408107.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update CVE-2025-408117.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update
CVE-2025-40800: High severity, CVSS 7.4 | Vulnix