CVE-2025-40745

CVE-2025-40745 is an improper certificate validation vulnerability affecting multiple Siemens applications including Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025/SE2026, and Tecnomatix Plant Simulation. The flaw allows unauthenticated remote attackers to conduct man-in-the-middle (MITM) attacks by exploiting the applications' failure to properly validate client certificates when connecting to the Analytics Service endpoint. All versions below specific thresholds are vulnerable, with patched versions available for each product. The vulnerability carries a CVSS score of 3.7 (LOW) with a network-based attack vector that requires high attack complexity. The impact is limited to confidentiality, with no integrity or availability concerns. This suggests the attacker would need favorable network conditions and potentially specific timing or configuration to succeed, and any information disclosure would be minimal. There is no evidence of active exploitation in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) database and has no public exploit code availability. Community attention remains minimal, as reflected by the extremely low EPSS score of 0.00022, indicating this poses a lower risk compared to the broader CVE landscape. Organizations should apply available patches during routine maintenance cycles.