CVE-2025-40745: Siemens Analytics Toolkit MitM — Detection and Remediation Guide

---
title: Siemens Analytics Toolkit - Potentially Vulnerable Product Execution
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects the execution of applications affected by CVE-2025-40745. Presence of these processes indicates a host may require immediate patching to prevent Man-in-the-Middle attacks via the Siemens Analytics Toolkit.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-04
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.credential_access
  - attack.t1557.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\SoftwareCenter.exe'
      - '\Simcenter3D.exe'
      - '\Femap.exe'
      - '\starccm+.exe'
      - '\SolidEdge.exe'
      - '\PlantSimulation.exe'
  condition: selection
falsepositives:
  - Legitimate engineering workflows (verify version integrity)
level: high
---
title: Siemens Software Center Network Connection
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects network connections initiated by the Siemens Software Center. Monitoring these connections helps identify potential data exfiltration vectors or updates that could be intercepted in MitM scenarios.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-04
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\SoftwareCenter.exe'
      - '\Siemens.Analytics.Toolkit.exe'
  filter_localhost:
    DestinationIp:
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter_localhost
falsepositives:
  - Legitimate software updates and licensing checks
level: medium

// Hunt for execution of affected Siemens engineering applications
// Join with DeviceNetworkEvents to identify internet-facing activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has_any ("SoftwareCenter.exe", "Simcenter3D.exe", "Femap.exe", "starccm+.exe", "SolidEdge.exe", "PlantSimulation.exe")
| project Timestamp, DeviceName, AccountName, ProcessName, FolderPath, InitiatingProcessFileName
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessName has_any ("SoftwareCenter", "Simcenter", "SolidEdge")
    | summarize RemoteIPs=make_set(RemoteIP), RemotePorts=make_set(RemotePort) by DeviceName, InitiatingProcessName
) on DeviceName
| project-away DeviceName1

-- Hunt for vulnerable Siemens applications and report file versions
-- This helps identify assets that are candidates for CVE-2025-40745 patching
SELECT OSPath, Mtime, Size, 
       parse_string(data=Version.Description, regex="(?P<Version>\d+\.\d+\.\d+\.\d+)").Version as AppVersion
FROM glob(globs="/*")
WHERE Name =~ "SoftwareCenter.exe" 
   OR Name =~ "Simcenter3D.exe" 
   OR Name =~ "Femap.exe" 
   OR Name =~ "starccm+.exe" 
   OR Name =~ "SolidEdge.exe" 
   OR Name =~ "PlantSimulation.exe"

# PowerShell Script to Check Vulnerable Versions of Siemens Products
#针对 CVE-2025-40745

$VulnerableVersions = @{
    "SoftwareCenter.exe" = "3.5.8.2"
    "Simcenter3D.exe"    = "2506.6000"
    "Femap.exe"          = "2506.0002"
    "starccm+.exe"       = "2602"
    "SolidEdge.exe"      = "2025" # Check year version specifically for SE2025
}

$CommonPaths = @(
    "${env:ProgramFiles}\Siemens",
    "${env:ProgramFiles(x86)}\Siemens",
    "${env:ProgramFiles}\Solid Edge",
    "${env:ProgramFiles(x86)}\Solid Edge",
    "${env:ProgramFiles}\Siemens\Software Center"
)

Write-Host "Scanning for vulnerable Siemens applications related to CVE-2025-40745..." -ForegroundColor Cyan

foreach ($Path in $CommonPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $VulnerableVersions.ContainsKey($_.Name) } |
        ForEach-Object {
            $FilePath = $_.FullName
            $FileVersion = (Get-Item $FilePath).VersionInfo.FileVersion
            $FileName = $_.Name
            $TargetVersion = $VulnerableVersions[$FileName]
            
            # Basic version comparison logic (simplified for script)
            # Note: Siemens internal versioning (intdot) may differ from FileVersion
            # This script detects presence; manual verification of specific 'intdot' build is required.
            Write-Host "FOUND: $FileName at $FilePath" -ForegroundColor Yellow
            Write-Host "  Detected Version: $FileVersion"
            Write-Host "  Action: Compare detected version against vendor advisory $TargetVersion." -ForegroundColor Red
        }
    }
}
Write-Host "Scan complete. Please review the Siemens ProductCERT advisory for exact update coordinates." -ForegroundColor Green

Update the affected products to the following versions or later: