8.5

CVE-2025-40945

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSiemens
≫
Produkt COMOS V10.4.5
Default Statusunknown
Version 0
Version < V10.4.5.0.2
Status affected
HerstellerSiemens
≫
Produkt COMOS V10.6
Default Statusunknown
Version 0
Version < V10.6.1
Status affected
HerstellerSiemens
≫
Produkt Designcenter NX
Default Statusunknown
Version 0
Version < V2512.7000
Status affected
HerstellerSiemens
≫
Produkt Simcenter 3D
Default Statusunknown
Version 0
Version < V2512.7000
Status affected
HerstellerSiemens
≫
Produkt Simcenter Femap V2506
Default Statusunknown
Version 0
Version < V2506.0003
Status affected
HerstellerSiemens
≫
Produkt Simcenter Femap V2512
Default Statusunknown
Version 0
Version < V2512.0002
Status affected
HerstellerSiemens
≫
Produkt Simcenter Nastran
Default Statusunknown
Version 0
Version < V2606
Status affected
HerstellerSiemens
≫
Produkt Simcenter STAR-CCM+
Default Statusunknown
Version 0
Version < V2606
Status affected
HerstellerSiemens
≫
Produkt Solid Edge SE2025
Default Statusunknown
Version 0
Version < V225.0 Update 13
Status affected
HerstellerSiemens
≫
Produkt Solid Edge SE2026
Default Statusunknown
Version 0
Version < V226.0 Update 04
Status affected
HerstellerSiemens
≫
Produkt Teamcenter Visualization V2412
Default Statusunknown
Version 0
Version < V2412.0012
Status affected
HerstellerSiemens
≫
Produkt Teamcenter Visualization V2506
Default Statusunknown
Version 0
Version < V2506.0009
Status affected
HerstellerSiemens
≫
Produkt Teamcenter Visualization V2512
Default Statusunknown
Version 0
Version < V2512.2605
Status affected
HerstellerSiemens
≫
Produkt Tecnomatix Plant Simulation V2404
Default Statusunknown
Version 0
Version < V2404.0022
Status affected
HerstellerSiemens
≫
Produkt Tecnomatix Plant Simulation V2504
Default Statusunknown
Version 0
Version < V2504.0010
Status affected
HerstellerSiemens
≫
Produkt Tecnomatix Process Simulate
Default Statusunknown
Version 0
Version < V2606
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.016
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Siemens 8.5 0 0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Siemens 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

https://cert-portal.siemens.com/productcert/html/ssa-288252.html