EUVD-2025-209431
GHSA-vv4w-99g8-93pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker gains network position via ARP spoofing or DNS interception
-
DeliveryIntercepts TLS handshake to Analytics Service endpoint
-
ExploitPresents forged server certificate to victim client
-
InstallClient accepts invalid certificate due to improper validation
-
C2Attacker establishes MITM connection
-
ExecuteDecrypt and eavesdrop on analytics telemetry and metadata
-
ImpactDisclose sensitive information to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Impact | The CVSS 3.7 score reflects low real-world severity despite network-based access: attack complexity is HIGH (AC:H), indicating the attacker must control network position and intercept traffic, and the impact is LIMITED to confidentiality (C:L) with no integrity or availability impact. EPSS and KEV data are not provided, but absence of public exploit code and active exploitation reports suggest this is not a high-priority target for adversaries at the time of analysis. However, this vulnerability is relevant in high-security environments (automotive, aerospace, manufacturing) where Siemens tools are critical and where network segmentation may be weak or insider threats present. The low barrier to exploitation (once on-path) and the breadth of affected products (seven major application families) elevate its importance for organizations using multiple Siemens engineering suites. The information disclosure risk is moderate-Analytics Service likely transmits product usage data, license information, or project metadata-but not critical system compromise. |
| Exploit ScenarioDerived | An attacker positioned on a corporate network (e.g., compromised WiFi router, rogue switch, or network tap) intercepts DNS or ARP traffic to redirect an Analytics Service endpoint to a machine under attacker control. When a user launches a vulnerable Siemens application (e.g., Solid Edge), the client initiates a TLS connection to the Analytics Service but fails to validate the server certificate, accepting the attacker's forged certificate. The attacker decrypts the session and observes telemetry data, project metadata, and license tokens transmitted by the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Improper TLS certificate validation in Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025/SE2026, and Tecnomatix Plant Simulation allows unauthenticated remote attackers to perform man-in-the-middle attacks against the Analytics Service endpoint. An attacker positioned on the network path can intercept and decrypt communications, potentially disclosing sensitive information. CVSS 3.7 reflects low-severity impact; no public exploit or active exploitation confirmed, but the low attack complexity and network vector indicate practical exploitability in targeted enterprise environments.
RemediationAI
Upgrade to the following patched versions: Siemens Software Center V3.5.8.2 or later, Simcenter 3D V2506.6000 or later, Simcenter Femap V2506.0002 or later, Simcenter STAR-CCM+ V2602 or later, Solid Edge SE2025 V225.0 Update 13 or later, Solid Edge SE2026 V226.0 Update 04 or later, and Tecnomatix Plant Simulation V2504.0008 or later. As an interim mitigation, isolate affected applications on networks with strict egress controls and monitor outbound connections to Analytics Service endpoints. Organizations should verify that network security controls (firewalls, proxies, or VPNs) enforce certificate pinning or trusted CA validation before permitting connections to Siemens backend services. Consult the Siemens product security advisory at https://cert-portal.siemens.com/productcert/html/ssa-981622.html for product-specific deployment guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from inadequate X.509 certificate validation during TLS handshakes with the Analytics Service endpoint (CWE-295: Improper Certificate Validation). Affected Siemens applications fail to properly verify the authenticity of the server's certificate, enabling a network-adjacent attacker to present a forged certificate and establish a trusted-appearing connection. The Analytics Service is a backend component used for telemetry and product analytics across multiple Siemens engineering suites (CAD, simulation, manufacturing software). Without proper certificate chain and hostname verification, these applications accept connections from attackers controlling network infrastructure (routers, proxies, DNS) or positioned via ARP spoofing, allowing passive eavesdropping on encrypted channels that should be protected.
Know when Siemens Software Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (siemens) · only source for this CVE.
CVSS VectorVendor: siemens
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB