Man-in-the-Middle Vulnerability in Siemens COMOS and NX Products
CVE-2025-40800
9.1CRITICAL
Key Information:
- Vendor
Siemens
- Vendor
- CVE Published:
- 9 December 2025
What is CVE-2025-40800?
A significant security flaw has been detected in several Siemens products, where the IAM client fails to validate server certificates during TLS connections to the authorization server. This lack of validation can potentially allow attackers to intercept and manipulate communication between the client and server, making it vulnerable to man-in-the-middle attacks. Users of affected versions must take immediate action to mitigate potential risks associated with this vulnerability.
Affected Version(s)
COMOS V10.6 0
COMOS V10.6 0
NX V2412 0