# Siemens IAM Client Flaw Opens Privilege Escalation Path Across 16 Engineering Products


## The Threat


An unquoted search path vulnerability in Siemens' IAM Client SDK lets any authenticated local user escalate their privileges to a higher-privileged account on the affected machine. The flaw, tracked as CVE-2025-40945, traces back to CWE-426 — a class of weakness that has existed since the early days of Windows path resolution and remains stubbornly persistent in enterprise software bundles.


The mechanics are straightforward but effective. When a Windows executable path contains spaces and lacks proper quoting, the OS attempts to resolve the path by trying shorter segments first. An attacker who can write to a directory earlier in the resolution chain can plant a malicious binary that gets executed with elevated privileges instead of the intended program. No exploit toolkit required — just a local account and knowledge of the affected path.


What makes this one notable is the breadth of Siemens software it touches. IAM Client is a shared authentication component bundled across Siemens' PLM and simulation product portfolio — COMOS, Solid Edge, Simcenter, Teamcenter Visualization, Tecnomatix, and several others. Sixteen distinct product lines carry the vulnerable SDK, all of them tools commonly deployed in engineering environments supporting chemical plants, energy infrastructure, and critical manufacturing. The attack surface isn't a niche appliance; it's the workstation fleet of industrial design teams worldwide.


## Severity and Impact


| Field | Detail |

|---|---|

| CVE | CVE-2025-40945 |

| CWE | CWE-426 — Untrusted Search Path |

| CVSS v3 Base Score | 6.7 (Medium) |

| Vector String | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |

| Attack Vector | Local |

| Attack Complexity | Low |

| Privileges Required | Low (authenticated user) |

| User Interaction | None |

| Scope | Unchanged |


The CVSS score of 6.7 understates operational risk in environments where engineering workstations hold design data, simulation credentials, or connections to OT networks. Local access is the gating requirement — and insider threat scenarios, compromised contractor accounts, or pivot from a phishing-delivered foothold all satisfy that bar.


## Affected Products


Siemens has confirmed the following product versions are vulnerable:


COMOS

  • COMOS V10.4.5 — versions prior to V10.4.5.0.2
  • COMOS V10.6 — versions prior to V10.6.1

    • NX / Designcenter

  • Designcenter NX — versions prior to V2512.7000

    • Simcenter Suite

  • Simcenter 3D — versions prior to V2512.7000
  • Simcenter Femap V2506 — versions prior to V2506.0003
  • Simcenter Femap V2512 — versions prior to V2512.0002
  • Simcenter Nastran — versions prior to V2606
  • Simcenter STAR-CCM+ — versions prior to V2606

    • Solid Edge

  • Solid Edge SE2025 — versions prior to V225.0.13.3 (Update 13)
  • Solid Edge SE2026 — versions prior to V226.0.04.003 (Update 04)

    • Teamcenter Visualization

  • Teamcenter Visualization V2412 — versions prior to V2412.0012
  • Teamcenter Visualization V2506 — versions prior to V2506.0009
  • Teamcenter Visualization V2512 — versions prior to V2512.2605

    • Tecnomatix

  • Tecnomatix Plant Simulation V2404 — versions prior to V2404.0022
  • Tecnomatix Plant Simulation V2504 — versions prior to V2504.0010
  • Tecnomatix Process Simulate — versions prior to V2606

    • ## Mitigations


    Siemens has released patched versions for most affected products. Patch to the following versions at minimum:


    | Product | Minimum Fixed Version | Support Link |

    |---|---|---|

    | COMOS V10.4.5 | V10.4.5.0.2 | Contact Siemens customer support |

    | COMOS V10.6 | V10.6.1 | https://support.sw.siemens.com/product/222981661/ |

    | Solid Edge SE2025 | V225.0 Update 13 | https://support.sw.siemens.com/product/246738425/ |

    | Solid Edge SE2026 | V226.0 Update 04 | https://support.sw.siemens.com/product/246738425/ |

    | Tecnomatix Plant Sim V2404 | V2404.0022 | https://support.sw.siemens.com/product/297028302/ |

    | Tecnomatix Plant Sim V2504 | V2504.0010 | https://support.sw.siemens.com/product/297028302/ |

    | Simcenter Femap V2506 | V2506.0003 | https://support.sw.siemens.com/product/275652363/ |

    | Simcenter Femap V2512 | V2512.0002 | https://support.sw.siemens.com/product/275652363/ |

    | Teamcenter Vis V2412 | V2412.0012 | https://support.sw.siemens.com/product/229029598/ |

    | Teamcenter Vis V2506 | V2506.0009 | https://support.sw.siemens.com/product/229029598/ |

    | Teamcenter Vis V2512 | V2512.2605 | https://support.sw.siemens.com/product/229029598/ |

    | Designcenter NX / Simcenter 3D | V2512.7000 | https://support.sw.siemens.com/product/209349590/ |

    | Simcenter Nastran / STAR-CCM+ / Process Simulate | V2606 | https://support.sw.siemens.com/product/289054037/ |


    For products where patches are not yet available, Siemens recommends applying the principle of least privilege — ensure that engineering workstation accounts cannot write to directories in the system PATH or program installation trees. Where feasible, restrict local logon access to workstations running these tools to personnel with a legitimate operational need. Monitoring for unusual process execution chains from Siemens software directories can provide early detection.


    ## References


  • [ICS-CERT Advisory — Siemens IAM Client (CVE-2025-40945)](https://www.cisa.gov/news-events/ics-advisories/)
  • [Siemens ProductCERT Security Advisory](https://cert.siemens.com/)
  • [Siemens Software Support Portal](https://support.sw.siemens.com/)
  • [NVD Entry — CVE-2025-40945](https://nvd.nist.gov/vuln/detail/CVE-2025-40945)

    • ---


    ## HackWire Analysis


    The unquoted search path class of vulnerability (CWE-426) is old enough to have its own Wikipedia page. Microsoft documented the resolution behavior in Windows NT-era documentation. Security researchers have been flagging it in enterprise software installers for two decades. The fact that it's surfacing in 2025 across a flagship industrial software portfolio should provoke more than a patch advisory — it should prompt a conversation about SDK quality gates.


    What's happening here is almost certainly a shared component problem. IAM Client is an authentication SDK that Siemens embeds across its entire PLM stack. When one component has a structural flaw in how it specifies executable paths, the blast radius is proportional to how widely that component is distributed. Sixteen products. Chemical plants. Energy firms. Advanced manufacturing sites. That's a long tail for a class of bug that static analysis tooling catches reliably.


    The practical threat model deserves honest framing. This is not a remote code execution vulnerability — an attacker needs a local account first. But "local account" in an industrial context can mean a shared engineering workstation, a vendor remote access session, or a contractor account that persists long after the engagement ends. Many OT-adjacent environments have notoriously poor account hygiene, and engineering workstations often sit at the intersection of the IT network and design data that feeds production systems. Privilege escalation on that class of host is not a trivial finding.


    Organizations running any Siemens PLM software should treat this as a patch-now item, not a patch-next-quarter item. Audit your installed versions against the affected list, cross-reference with your remote access inventory, and verify that workstation accounts are running at minimum necessary privilege while patches are staged and tested.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)