CVE-2025-40818

LowCVSS 3.3/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-408194.3A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validatCVE-2025-40825.9Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could CVE-2025-408207.5Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This CVE-2025-408277.8A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). TCVE-2025-408297.8A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vuCVE-2025-40839.1A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute inCVE-2025-408306.7A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorCVE-2025-408316.5A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of dCVE-2025-408337.5The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an CVE-2025-408345.7A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the iCVE-2025-408369.8Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commandCVE-2025-408378.8Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with