CVE-2025-40945

Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens IAM Client are affected: COMOS V10.4.5 vers:intdot/COMOS V10.6 vers:intdot/Designcenter NX vers:intdot/Simcenter 3D vers:intdot/Simcenter Femap V2506 vers:intdot/Simcenter Femap V2512 vers:intdot/Simcenter Nastran vers:intdot/Simcenter STAR-CCM+ vers:intdot/Solid Edge SE2025 vers:intdot/Solid Edge SE2026 vers:intdot/Teamcenter Visualization V2412 vers:intdot/Teamcenter Visualization V2506 vers:intdot/Teamcenter Visualization V2512 vers:intdot/Tecnomatix Plant Simulation V2404 vers:intdot/Tecnomatix Plant Simulation V2504 vers:intdot/Tecnomatix Process Simulate vers:intdot/ CVSS Vendor Equipment Vulnerabilities v3 6.7 Siemens Siemens IAM Client Untrusted Search Path Background Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany

EPSS 0.11% · 1.6th percentile