SSA-288252

Vulnerability from csaf_siemens - Published: 2026-07-14 00:00 - Updated: 2026-07-14 00:00
Summary
SSA-288252: Unquoted Search Path Vulnerability in IAM Client
Notes
Summary: Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use: The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
CVE-2025-40945

Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-426 - Untrusted Search Path
Affected products
Product Identifier Version Remediation
COMOS V10.4.5 < V10.4.5.0.2
Siemens / COMOS V10.4.5
 vers:intdot/<10.4.5.0.2
Vendor Fix
COMOS V10.6 < V10.6.1
Siemens / COMOS V10.6
 vers:intdot/<10.6.1
Vendor Fix fix
Designcenter NX < V2512.7000
Siemens / Designcenter NX
 vers:intdot/<2512.7000
Vendor Fix fix
Simcenter 3D < V2512.7000
Siemens / Simcenter 3D
 vers:intdot/<2512.7000
Vendor Fix fix
Simcenter Femap V2506 < V2506.0003
Siemens / Simcenter Femap V2506
 vers:intdot/<2506.0003
Vendor Fix fix
Simcenter Femap V2512 < V2512.0002
Siemens / Simcenter Femap V2512
 vers:intdot/<2512.0002
Vendor Fix fix
Simcenter Nastran < V2606
Siemens / Simcenter Nastran
 vers:intdot/<2606
Vendor Fix fix
Simcenter STAR-CCM+ < V2606
Siemens / Simcenter STAR-CCM+
 vers:intdot/<2606
Vendor Fix fix
Solid Edge SE2025 < V225.0.13.3
Siemens / Solid Edge SE2025
 vers:intdot/<225.0.13.3
Vendor Fix fix
Solid Edge SE2026 < V226.0.04.003
Siemens / Solid Edge SE2026
 vers:intdot/<226.0.04.003
Vendor Fix fix
Teamcenter Visualization V2412 < V2412.0012
Siemens / Teamcenter Visualization V2412
 vers:intdot/<2412.0012
Vendor Fix fix
Teamcenter Visualization V2506 < V2506.0009
Siemens / Teamcenter Visualization V2506
 vers:intdot/<2506.0009
Vendor Fix fix
Teamcenter Visualization V2512 < V2512.2605
Siemens / Teamcenter Visualization V2512
 vers:intdot/<2512.2605
Vendor Fix fix
Tecnomatix Plant Simulation V2404 < V2404.0022
Siemens / Tecnomatix Plant Simulation V2404
 vers:intdot/<2404.0022
Vendor Fix fix
Tecnomatix Plant Simulation V2504 < V2504.0010
Siemens / Tecnomatix Plant Simulation V2504
 vers:intdot/<2504.0010
Vendor Fix fix
Tecnomatix Process Simulate < V2606
Siemens / Tecnomatix Process Simulate
 vers:intdot/<2606
Vendor Fix fix
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-288252: Unquoted Search Path Vulnerability in IAM Client - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-288252.html"
      },
      {
        "category": "self",
        "summary": "SSA-288252: Unquoted Search Path Vulnerability in IAM Client - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-288252.json"
      }
    ],
    "title": "SSA-288252: Unquoted Search Path Vulnerability in IAM Client",
    "tracking": {
      "current_release_date": "2026-07-14T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-288252",
      "initial_release_date": "2026-07-14T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-07-14T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c10.4.5.0.2",
                "product": {
                  "name": "COMOS V10.4.5 \u003c V10.4.5.0.2",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "COMOS V10.4.5"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c10.6.1",
                "product": {
                  "name": "COMOS V10.6 \u003c V10.6.1",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "COMOS V10.6"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2512.7000",
                "product": {
                  "name": "Designcenter NX \u003c V2512.7000",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Designcenter NX"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2512.7000",
                "product": {
                  "name": "Simcenter 3D \u003c V2512.7000",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter 3D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2506.0003",
                "product": {
                  "name": "Simcenter Femap V2506 \u003c V2506.0003",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter Femap V2506"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2512.0002",
                "product": {
                  "name": "Simcenter Femap V2512 \u003c V2512.0002",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter Femap V2512"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2606",
                "product": {
                  "name": "Simcenter Nastran \u003c V2606",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter Nastran"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2606",
                "product": {
                  "name": "Simcenter STAR-CCM+ \u003c V2606",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter STAR-CCM+"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c225.0.13.3",
                "product": {
                  "name": "Solid Edge SE2025 \u003c V225.0.13.3",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "Solid Edge SE2025"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c226.0.04.003",
                "product": {
                  "name": "Solid Edge SE2026 \u003c V226.0.04.003",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "Solid Edge SE2026"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2412.0012",
                "product": {
                  "name": "Teamcenter Visualization V2412 \u003c V2412.0012",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter Visualization V2412"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2506.0009",
                "product": {
                  "name": "Teamcenter Visualization V2506 \u003c V2506.0009",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter Visualization V2506"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2512.2605",
                "product": {
                  "name": "Teamcenter Visualization V2512 \u003c V2512.2605",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter Visualization V2512"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2404.0022",
                "product": {
                  "name": "Tecnomatix Plant Simulation V2404 \u003c V2404.0022",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "Tecnomatix Plant Simulation V2404"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2504.0010",
                "product": {
                  "name": "Tecnomatix Plant Simulation V2504 \u003c V2504.0010",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "Tecnomatix Plant Simulation V2504"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2606",
                "product": {
                  "name": "Tecnomatix Process Simulate \u003c V2606",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "Tecnomatix Process Simulate"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-40945",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "description",
          "text": "Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V10.6.1 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.sw.siemens.com/product/222981661/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V225.0 Update 13 or later version",
          "product_ids": [
            "9"
          ],
          "url": "https://support.sw.siemens.com/product/246738425/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V226.0 Update 04 or later version",
          "product_ids": [
            "10"
          ],
          "url": "https://support.sw.siemens.com/product/246738425/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2404.0022 or later version",
          "product_ids": [
            "14"
          ],
          "url": "https://support.sw.siemens.com/product/297028302/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2412.0012 or later version",
          "product_ids": [
            "11"
          ],
          "url": "https://support.sw.siemens.com/product/229029598/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2504.0010 or later version",
          "product_ids": [
            "15"
          ],
          "url": "https://support.sw.siemens.com/product/297028302/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2506.0003 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.sw.siemens.com/product/275652363/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2506.0009 or later version",
          "product_ids": [
            "12"
          ],
          "url": "https://support.sw.siemens.com/product/229029598/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2512.0002 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.sw.siemens.com/product/275652363/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2512.2605 or later version",
          "product_ids": [
            "13"
          ],
          "url": "https://support.sw.siemens.com/product/229029598/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2512.7000 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://support.sw.siemens.com/product/209349590/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2512.7000 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.sw.siemens.com/product/289054037/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2606 or later version",
          "product_ids": [
            "7",
            "8",
            "16"
          ],
          "url": "https://support.sw.siemens.com/product/289054037/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16"
          ]
        }
      ],
      "title": "CVE-2025-40945"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.