Siemens Software Center Analytics Service Endpoint certificate validation

Summaryinfo

A vulnerability was found in Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025, Solid Edge SE2026 and Tecnomatix Plant Simulation and classified as critical. The impacted element is an unknown function of the component Analytics Service Endpoint. Executing a manipulation can lead to certificate validation. This vulnerability appears as CVE-2025-40745. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025, Solid Edge SE2026 and Tecnomatix Plant Simulation. It has been declared as problematic. This vulnerability affects an unknown code of the component Analytics Service Endpoint. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. CVE summarizes:

A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.

The advisory is available at cert-portal.siemens.com. This vulnerability was named CVE-2025-40745 since 04/16/2025. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/14/2026). This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• SCADA Software

Vendor

• Siemens

Name

• Simcenter 3D
• Simcenter Femap
• Simcenter STAR-CCM+
• Software Center
• Solid Edge SE2025
• Solid Edge SE2026
• Tecnomatix Plant Simulation

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion