CVE-2025-40744: Solid Edge SE2025 Auth Bypass Vulnerability

CVE-2025-40744 Overview

CVE-2025-40744 is an improper certificate validation flaw [CWE-295] in Siemens Solid Edge SE2025, affecting all versions prior to V225.0 Update 11. The affected application fails to properly validate client certificates when connecting to the License Service endpoint. An unauthenticated remote attacker can exploit this weakness to perform man-in-the-middle (MITM) attacks against the licensing communication channel. Successful exploitation enables interception or manipulation of data exchanged between the client and the licensing endpoint.

Critical Impact

Unauthenticated network attackers can intercept License Service traffic and compromise the confidentiality of data exchanged between Solid Edge SE2025 clients and the licensing endpoint.

Affected Products

• Siemens Solid Edge SE2025 — all versions before V225.0 Update 11
• License Service endpoint component bundled with Solid Edge SE2025
• Workstations running vulnerable Solid Edge SE2025 installations

Discovery Timeline

• 2025-11-11 - CVE-2025-40744 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40744

Vulnerability Analysis

The vulnerability stems from missing or incomplete client certificate validation during the Transport Layer Security (TLS) handshake between Solid Edge SE2025 and the License Service endpoint. When a client trusts certificates that should be rejected, the trust assumptions underpinning TLS break down. An attacker positioned on the network path between the client and the licensing endpoint can present a fraudulent certificate and establish a session the client accepts as legitimate.

This Man-in-the-Middle condition allows the attacker to observe license traffic in cleartext after TLS termination at the attacker-controlled proxy. The flaw maps to [CWE-295] Improper Certificate Validation. The advisory limits the documented impact to confidentiality of data in transit, with no integrity or availability impact reported.

Root Cause

The root cause is the client's failure to enforce strict validation of the certificate presented by the License Service endpoint. Proper validation requires verifying the certificate chain to a trusted root, checking revocation status, validating the subject name against the expected endpoint, and rejecting self-signed or untrusted certificates. The affected Solid Edge SE2025 builds do not apply these checks correctly to the licensing channel.

Attack Vector

Exploitation requires network adjacency to the licensing traffic path. No authentication and no user interaction are required. An attacker capable of redirecting or proxying traffic, such as through Address Resolution Protocol (ARP) spoofing, rogue DNS responses, or compromised network infrastructure, can present a forged certificate. The Solid Edge SE2025 client establishes the TLS session with the attacker, who then relays traffic to the legitimate endpoint while observing the cleartext data. See the Siemens Security Advisory SSA-522291 for additional vendor technical details.

Detection Methods for CVE-2025-40744

Indicators of Compromise

• TLS sessions from Solid Edge SE2025 clients terminating at unexpected IP addresses or hostnames rather than the documented Siemens License Service endpoint.
• Presentation of certificates not chained to Siemens-issued or expected enterprise certificate authorities on licensing connections.
• Unexpected ARP table changes or DNS responses on subnets hosting engineering workstations running Solid Edge SE2025.

Detection Strategies

• Inspect outbound TLS traffic from engineering workstations and alert on License Service connections that present certificates outside an allowlist of expected issuers.
• Correlate Solid Edge process activity (solidedge.exe and related licensing client processes) with the destination IP and certificate fingerprint of their TLS sessions.
• Hunt for installations of Solid Edge SE2025 versions below V225.0 Update 11 across the asset inventory.

Monitoring Recommendations

• Enable network traffic analysis on segments hosting computer-aided design (CAD) workstations to capture TLS metadata and certificate fingerprints.
• Monitor for layer-2 anomalies such as ARP spoofing and gratuitous ARP replies that often precede MITM attacks.
• Track software inventory telemetry to flag any Solid Edge SE2025 host that drifts back to a vulnerable build.

How to Mitigate CVE-2025-40744

Immediate Actions Required

• Upgrade all Solid Edge SE2025 installations to V225.0 Update 11 or later as published by Siemens.
• Restrict network paths between Solid Edge SE2025 clients and the License Service endpoint to trusted, segmented networks until patching is complete.
• Audit certificate authority trust stores on engineering workstations and remove unnecessary or untrusted root certificates.

Patch Information

Siemens has released a fixed build addressing CVE-2025-40744. Apply Solid Edge SE2025 V225.0 Update 11 or later. Refer to the Siemens Security Advisory SSA-522291 for vendor patch instructions and download locations.

Workarounds

• Place Solid Edge SE2025 clients on isolated VLANs with strict egress controls limiting connections to known License Service IP ranges.
• Deploy port security, Dynamic ARP Inspection, and DHCP snooping on switches serving engineering workstations to limit MITM positioning.
• Use enterprise certificate pinning at the proxy or firewall layer to reject unexpected certificates on licensing traffic until clients are patched.

# Configuration example: enable Dynamic ARP Inspection on a Cisco switch VLAN
# to reduce ARP-spoofing-based MITM risk against Solid Edge License traffic
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 100
ip arp inspection vlan 100
interface GigabitEthernet0/1
  ip dhcp snooping trust
  ip arp inspection trust
end