{"id":"CVE-2025-40800","aliases":["EUVD-2025-201929","GHSA-xg9v-jc69-p54f"],"status":"published","title":"A vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), NX...","description":"A vulnerability has been identified in COMOS V10.6 (All versions \u003c V10.6.1), COMOS V10.6 (All versions \u003c V10.6.1), NX V2412 (All versions \u003c V2412.8700), NX V2506 (All versions \u003c V2506.6000), Simcenter 3D (All versions \u003c V2506.6000), Simcenter Femap (All versions \u003c V2506.0002), Solid Edge SE2025 (All versions \u003c V225.0 Update 10), Solid Edge SE2026 (All versions \u003c V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.","severity":{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00215,"percentile":0.11936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2025-12-09T10:44:23Z","modified":"2026-10-07T11:10:00Z","products":[{"vendor":"siemens","product":"comos v10.6"},{"vendor":"siemens","product":"nx v2412"},{"vendor":"siemens","product":"nx v2506"},{"vendor":"siemens","product":"simcenter 3d"},{"vendor":"siemens","product":"simcenter femap"},{"vendor":"siemens","product":"solid edge se2025"},{"vendor":"siemens","product":"solid edge se2026"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-868571.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-212953.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40800"},{"url":"https://github.com/advisories/GHSA-xg9v-jc69-p54f"}],"sources":{"cve":[{"id":"CVE-2025-40800","description":"A vulnerability has been identified in COMOS V10.6 (All versions \u003c V10.6.1), COMOS V10.6 (All versions \u003c V10.6.1), NX V2412 (All versions \u003c V2412.8700), NX V2506 (All versions \u003c V2506.6000), Simcenter 3D (All versions \u003c V2506.6000), Simcenter Femap (All versions \u003c V2506.0002), Solid Edge SE2025 (All versions \u003c V225.0 Update 10), Solid Edge SE2026 (All versions \u003c V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.","status":"published","published":"2025-12-09T10:44:23.488Z","modified":"2026-03-10T16:07:47.742Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-201929","description":"A vulnerability has been identified in COMOS V10.6 (All versions \u003c V10.6.1), COMOS V10.6 (All versions \u003c V10.6.1), NX V2412 (All versions \u003c V2412.8700), NX V2506 (All versions \u003c V2506.6000), Simcenter 3D (All versions \u003c V2506.6000), Simcenter Femap (All versions \u003c V2506.0002), Solid Edge SE2025 (All versions \u003c V225.0 Update 10), Solid Edge SE2026 (All versions \u003c V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.","status":"published","published":"2025-12-09T10:44:23Z","modified":"2026-03-10T16:07:47Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:48:05.412027Z"}],"ghsa":[{"id":"GHSA-xg9v-jc69-p54f","title":"A vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), NX...","description":"A vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), NX V2412 (All versions \u003c V2412.8700), NX V2506 (All versions \u003c V2506.6000), Simcenter 3D (All versions \u003c V2506.6000), Simcenter Femap (All versions \u003c V2506.0002), Solid Edge SE2025 (All versions \u003c V225.0 Update 10), Solid Edge SE2026 (All versions \u003c V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.","status":"published","published":"2025-12-09T18:30:36Z","modified":"2025-12-09T18:30:43Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:05:06.487163Z"}],"nvd":[{"id":"CVE-2025-40800","description":"A vulnerability has been identified in COMOS V10.6 (All versions \u003c V10.6.1), COMOS V10.6 (All versions \u003c V10.6.1), NX V2412 (All versions \u003c V2412.8700), NX V2506 (All versions \u003c V2506.6000), Simcenter 3D (All versions \u003c V2506.6000), Simcenter Femap (All versions \u003c V2506.0002), Solid Edge SE2025 (All versions \u003c V225.0 Update 10), Solid Edge SE2026 (All versions \u003c V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.","status":"published","published":"2025-12-09T16:17:45.073Z","modified":"2026-10-07T11:10:00.153Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:11:49.093461Z"}]}}