A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Siemens
  • Simcenter 3d
  • Simcenter Femap
  • Simcenter Star-ccm\+
  • Software Center
  • Solid Edge Se2025
  • Solid Edge Se2026
  • Tecnomatix Plant Simulation

No data.

No data.

References
Link Providers
https://cert-portal.siemens.com/productcert/html/ssa-981622.html cve-icon cve-icon
History

Tue, 14 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Title Improper Client‑Certificate Validation Enables Man‑in‑the‑Middle Attacks in Siemens Software Products

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Siemens
Siemens simcenter 3d
Siemens simcenter Femap
Siemens simcenter Star-ccm\+
Siemens software Center
Siemens solid Edge Se2025
Siemens solid Edge Se2026
Siemens tecnomatix Plant Simulation
Vendors & Products Siemens
Siemens simcenter 3d
Siemens simcenter Femap
Siemens simcenter Star-ccm\+
Siemens software Center
Siemens solid Edge Se2025
Siemens solid Edge Se2026
Siemens tecnomatix Plant Simulation

Tue, 14 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2026-04-14T08:40:38.637Z

Updated: 2026-04-14T13:38:29.751Z

Reserved: 2025-04-16T08:39:30.030Z

Link: CVE-2025-40745

cve-icon Vulnrichment

Updated: 2026-04-14T13:38:03.182Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-14T09:16:34.683

Modified: 2026-04-17T15:18:16.507

Link: CVE-2025-40745

cve-icon Redhat

No data.