Loading vulnerability…
Missing TLS Server Certificate Validation in Siemens IAM Client
CVE-2025-40800 is a missing server certificate validation vulnerability in the IAM client integrated into Siemens COMOS, NX, Simcenter 3D, Simcenter Femap, and Solid Edge. When establishing TLS connections to the authorization server, the client fails to validate the server certificate, allowing an attacker positioned to intercept communications to impersonate the server and perform a man-in-the-middle attack. Affected versions include COMOS V10.6 before V10.6.1, NX V2412 before V2412.8700, NX V2506 before V2506.6000, Simcenter 3D before V2506.6000, Simcenter Femap before V2506.0002, Solid Edge SE2025 before V225.0 Update 10, and Solid Edge SE2026 before V226.0 Update 1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of communications between the IAM client and the authorization server through interception or manipulation. The CVSS v3.1 assessment indicates high confidentiality and integrity impacts and no availability impact.
If you can’t patch tonight, do this now.
Restrict network access to affected systems through appropriate access controls and operate them within a protected IT environment. Apply network segmentation, firewall restrictions, and secure remote access where applicable, following Siemens Industrial Security operational guidelines and product-specific security configuration guidance. No vulnerability-specific workaround is specified; these measures reduce exposure but do not correct the certificate validation flaw.
Patch, then assume compromise.
Upgrade to the applicable fixed release or later: COMOS V10.6.1; NX V2412.8700 or V2506.6000 for the corresponding release branch; Simcenter 3D V2506.6000; Simcenter Femap V2506.0002; Solid Edge SE2025 V225.0 Update 10; or Solid Edge SE2026 V226.0 Update 1.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.