A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Transla

Summary

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions < V2506.0001), Simcenter System Architect (All versions < V2506.0001), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Timeline

1. Dec 9, 2025, 10:44 AM UTCCVE published
2. Dec 9, 2025, 2:26 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Mar 10, 2026, 4:07 PM UTCRecord last updated

Affected versions

• Siemens COMOS V10.6

  fixed in V10.6.1

• Siemens COMOS V10.6

  fixed in V10.6.1

• Siemens JT Bi-Directional Translator for STEP

  All versions

• Siemens NX V2412

  fixed in V2412.8900

• Siemens NX V2506

  fixed in V2506.6000

• Siemens Simcenter 3D

  fixed in V2506.6000

• Siemens Simcenter Femap

  fixed in V2506.0002

• Siemens Simcenter Studio

  fixed in V2506.0001

• Siemens Simcenter System Architect

  fixed in V2506.0001

• Siemens Tecnomatix Plant Simulation

  fixed in V2504.0007

References 2