PT-2025-10735 · Siemens · Tecnomatix Plant Simulation

Published 2025-03-11 · Updated 2025-03-11 · CVE-2025-25266

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Tecnomatix Plant Simulation V2302 versions prior to V2302.0021 Tecnomatix Plant Simulation V2404 versions prior to V2404.0010

Description The affected application does not properly restrict access to the file deletion functionality, which could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting in potential data loss or unauthorized modification of system files.

Recommendations For Tecnomatix Plant Simulation V2302 versions prior to V2302.0021, update to version V2302.0021 or later to resolve the issue. For Tecnomatix Plant Simulation V2404 versions prior to V2404.0010, update to version V2404.0010 or later to resolve the issue. As a temporary workaround, consider restricting access to the file deletion functionality to minimize the risk of exploitation.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2025-02891

CVE-2025-25266

Affected Products

Tecnomatix Plant Simulation

References · 7

• https://cert-portal.siemens.com/productcert/html/ssa-507653.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02891 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-25266 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25266 · Vendor Advisory
• https://t.me/cvedetector/20076 · Telegram Post
• https://t.me/cvetracker/18923 · Telegram Post
• https://t.me/latest_high_impact_cve/1950 · Telegram Post