Siemens COMOS, NX, Simcenter, and Solid Edge Missing Server Certificate Validation Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability exists in multiple Siemens products, including COMOS V10.6, NX V2412 (prior to V2412.8700), NX V2506 (prior to V2506.6000), Simcenter 3D (prior to V2506.6000), Simcenter Femap (prior to V2506.0002), Solid Edge SE2025 (prior to V225.0 Update 10), and Solid Edge SE2026 (prior to V226.0 Update 1). The issue arises because the IAM client in these products does not validate server certificates when establishing TLS connections to the authorization server. This flaw could enable an attacker to conduct a man-in-the-middle attack.

Impact

Exploitation of this vulnerability could lead to unauthorized interception and manipulation of communications between the client and the authorization server, potentially allowing attackers to impersonate the server or alter the data being transmitted.

Remediation

Users of COMOS V10.6 should update to the latest version. For NX V2412, NX V2506, Simcenter 3D, Simcenter Femap, Solid Edge SE2025, and Solid Edge SE2026, users should update to the specified versions or later. Product-specific update instructions are available on the Siemens Support website.