Vulnerability · Published Apr 14, 2026 · Assigned by siemens
CVE-2025-40745
Low 3.7
In plain English
A low-severity improper certificate validation in Siemens Software Center from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Siemens Software Center | 0 – before V3.5.8.2 |
| Siemens | Simcenter 3D | 0 – before V2506.6000 |
| Siemens | Simcenter Femap | 0 – before V2506.0002 |
| Siemens | Simcenter STAR-CCM+ | 0 – before V2602 |
| Siemens | Solid Edge SE2025 | 0 – before V225.0 Update 13 |
| Siemens | Solid Edge SE2026 | 0 – before V226.0 Update 04 |
| Siemens | Tecnomatix Plant Simulation | 0 – before V2504.0008 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N