CVE-2025-40745 Security feature bypass in Siemens Software Center
Unauthenticated remote attackers can perform man-in-the-middle attacks due to improper client certificate validation in Siemens engineering applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40745?
CVE-2025-40745 is a medium-severity vulnerability in Siemens Simcenter Femap, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
Weakness: CWE-295
Which versions are affected by CVE-2025-40745?
It affects 7 products.
Products include Siemens Simcenter 3d, Siemens Simcenter Femap, Siemens Simcenter Star-Ccm\+ Viewer, Siemens Software Center, Siemens Solid Edge Se2025, Siemens Solid Edge Se2026 and 1 more.
How do I fix CVE-2025-40745?
No fix has been published for CVE-2025-40745 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40745 being exploited?
There is no known exploitation of CVE-2025-40745 in the wild and no public exploit code.
Sources
Also known as GHSA-vv4w-99g8-93pp.