CVE-2025-40945: Siemens IAM Client SDK Privilege Escalation

CVE-2025-40945 Overview

CVE-2025-40945 is an untrusted search path vulnerability [CWE-426] in the Siemens IAM Client SDK. The flaw affects a broad portfolio of Siemens engineering and simulation applications, including COMOS, Simcenter, Solid Edge, Teamcenter Visualization, and Tecnomatix product families. An authenticated local user can leverage the vulnerable search path behavior to escalate privileges on affected systems.

Critical Impact
An authenticated local attacker can place a malicious library in a location searched by the IAM Client SDK, achieving code execution with elevated privileges and full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Siemens COMOS V10.4.5 (versions before V10.4.5.0.2) and COMOS V10.6 (versions before V10.6.1)
Siemens Simcenter 3D, Designcenter NX, Simcenter Femap, Simcenter Nastran, and Simcenter STAR-CCM+ (multiple versions listed in Siemens advisory SSA-288252)
Siemens Solid Edge SE2025/SE2026, Teamcenter Visualization V2412/V2506/V2512, and Tecnomatix Plant Simulation and Process Simulate

Discovery Timeline

2026-07-14 - CVE-2025-40945 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2025-40945

Vulnerability Analysis

The vulnerability resides in the Siemens Identity and Access Management (IAM) Client SDK, a shared component embedded in numerous Siemens engineering products. The SDK resolves dependencies using an untrusted search path, meaning it loads libraries or executables from directories that a low-privileged local user can influence. When a privileged process invokes SDK functionality, the operating system may resolve a controlled path before the intended trusted location.

The attack requires only local access and low privileges, with no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability of the affected host. Because the IAM Client SDK is shipped across many Siemens product lines, a single vulnerable library exposes a wide range of industrial and engineering workstations.

Root Cause

The root cause is classified as CWE-426: Untrusted Search Path. The IAM Client SDK does not enforce absolute, trusted paths when locating supporting binaries or dynamic libraries. A local attacker who can write to a directory present in the search order can plant a malicious payload that the SDK loads at runtime.

Attack Vector

An authenticated local user places a crafted DLL or executable in a directory that appears earlier in the SDK's resolution order than the legitimate location. When a Siemens application initializes the IAM Client SDK, the malicious component is loaded into the process address space. If the host process runs with higher privileges, the attacker inherits those privileges. No verified proof-of-concept is publicly available at this time. See the Siemens Security Advisory SSA-288252 for full technical details.

Detection Methods for CVE-2025-40945

Indicators of Compromise

Unexpected DLL or executable files in application working directories, user-writable folders, or directories referenced by PATH
Siemens engineering processes (COMOS, Simcenter, Solid Edge, Teamcenter, Tecnomatix) loading modules from non-standard paths
Creation of new files with names matching legitimate IAM Client SDK dependencies in user-controlled locations

Detection Strategies

Monitor image load events for Siemens product processes and alert on modules loaded from paths outside the vendor installation directory
Baseline the legitimate module load set for each affected Siemens application and detect deviations
Correlate file writes to PATH-listed directories with subsequent process launches of affected applications

Monitoring Recommendations

Enable command-line and image load auditing (Sysmon Event ID 7, Windows Security Event 4688) on hosts running Siemens engineering software
Track process integrity level transitions and DLL hijacking indicators in EDR telemetry
Review file system ACLs on directories in the system and user PATH to identify locations writable by standard users

How to Mitigate CVE-2025-40945

Immediate Actions Required

Inventory all Siemens installations that embed the IAM Client SDK and identify hosts running vulnerable versions
Apply the fixed versions listed in Siemens advisory SSA-288252 as soon as they are available for each product
Restrict local login and interactive access to engineering workstations to trusted users only

Patch Information

Siemens has released fixed versions for the affected products. Consult the Siemens Security Advisory SSA-288252 for the exact fixed version per product, including COMOS V10.4.5.0.2, COMOS V10.6.1, Designcenter NX V2512.7000, Simcenter 3D V2512.7000, Simcenter Femap V2506.0003 and V2512.0002, Simcenter Nastran V2606, Simcenter STAR-CCM+ V2606, Solid Edge SE2025 Update 13 and SE2026 Update 04, Teamcenter Visualization V2412.0012 / V2506.0009 / V2512.2605, Tecnomatix Plant Simulation V2404.0022 and V2504.0010, and Tecnomatix Process Simulate V2606.

Workarounds

Remove write permissions for non-administrative users on directories present in the system PATH and application working directories
Enforce application allowlisting to prevent execution of unauthorized DLLs and binaries by Siemens processes
Follow Siemens ProductCERT operational guidelines to isolate engineering systems in dedicated, network-segmented environments

bash

# Audit user-writable directories in system PATH (Windows PowerShell)
$env:PATH -split ';' | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        $acl.Access | Where-Object {
            $_.IdentityReference -match 'Users|Everyone|Authenticated' -and
            $_.FileSystemRights -match 'Write|Modify|FullControl'
        } | ForEach-Object {
            Write-Output "Writable PATH entry: $_ -> $($_.IdentityReference)"
        }
    }
}