Description (CNA)
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Siemens / COMOS V10.6 | affected 0 before V10.6.1 |
| Siemens / COMOS V10.6 | affected 0 before V10.6.1 |
| Siemens / NX V2412 | affected 0 before V2412.8700 |
| Siemens / NX V2506 | affected 0 before V2506.6000 |
| Siemens / Simcenter 3D | affected 0 before V2506.6000 |
| Siemens / Simcenter Femap | affected 0 before V2506.0002 |
| Siemens / Solid Edge SE2025 | affected 0 before V225.0 Update 10 |
| Siemens / Solid Edge SE2026 | affected 0 before V226.0 Update 1 |
CWE
CWE-295
References
- https://cert-portal.siemens.com/productcert/html/ssa-868571.html
- https://cert-portal.siemens.com/productcert/html/ssa-212953.html
ADP enrichment
No English description supplied.
No references supplied.