top of page
perceptive_background_267k.jpg

Siemens IAM Client

Published:

11 December 2025 at 12:00:00

Alert date:

11 December 2025 at 22:03:18

Source:

cisa.gov

Click to open the original link from this advisory

Siemens IAM Client vulnerability allows man-in-the-middle attacks due to improper certificate validation during TLS connections. Affects multiple Siemens products including COMOS, NX, Simcenter, and Solid Edge. CVSS v4 score of 9.1 indicates high severity. Exploitable remotely by unauthenticated attackers. Updates available for most affected products except COMOS V10.6.

Technical details

The IAM client in affected Siemens products is missing server certificate validation while establishing TLS connections to the authorization server. This improper certificate validation (CWE-295) could allow an unauthenticated remote attacker to perform man-in-the-middle attacks. The vulnerability is exploitable remotely and has a CVSS v4 score of 9.1 and CVSS v3.1 score of 7.4.

Mitigation steps:

Update affected products to latest versions: Solid Edge SE2025 to V225.0 Update 10 or later, Solid Edge SE2026 to V226.0 Update 1 or later, NX V2412 to V2412.8700 or later, Simcenter Femap to V2506.0002 or later, NX V2506 to V2506.6000 or later, Simcenter 3D to V2506.6000 or later. No fix currently available for COMOS V10.6. Minimize network exposure for control systems, ensure systems are not accessible from internet, locate control system networks behind firewalls, use secure remote access methods like VPNs, implement defense-in-depth strategies, and follow Siemens operational guidelines for industrial security.

Affected products:

COMOS V10.6: All versions
NX V2412: All versions prior to 2412.8700
NX V2506: All versions prior to 2506.6000
Simcenter 3D: All versions prior to 2506.6000
Simcenter Femap: All versions prior to 2506.0002
Solid Edge SE2025: All versions prior to V225.0 Update 10
Solid Edge SE2026: All versions prior to V226.0 Update 1

Related links:

Related CVE's:

Related threat actors:

IOC's:

This article was created with the assistance of AI technology by Perceptive.

© 2025 by Perceptive Security. All rights reserved.

email: info@perceptivesecurity.com

Disclaimer: Deze website toont informatie afkomstig van externe bronnen. Perceptive aanvaardt geen verantwoordelijkheid voor de inhoud, juistheid of volledigheid van deze informatie.

bottom of page