CVE-2025-23363 Siemens CVE debrief

Who should care

Organizations running Siemens Teamcenter in one of the affected versions, especially environments where SSO login links are shared by email, chat, portals, or other external channels. Security teams should also care if Teamcenter is exposed to users who may trust login or SSO redirect links without verifying the destination.

Technical summary

The issue is described as the SSO login service accepting user-controlled input that can specify an external link. That creates an open-redirect-style condition in the login flow. If a user follows an attacker-crafted URL and then continues the login sequence, the user may be redirected to an attacker-controlled site. The advisory states this could be used to steal valid session data. The CVSS vector supplied with the advisory is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, reflecting network exposure, no privileges required, and required user interaction.

Defensive priority

High. The vulnerability is remotely reachable and can affect confidentiality if users are socially engineered into clicking a malicious link. Prioritize remediation in internet-facing or broadly user-accessible Teamcenter deployments, and treat it as a phishing-assisted session exposure risk.

Recommended defensive actions

• Update affected Teamcenter releases to Siemens-fixed versions where available: V14.3.0.14 or later, V2312.0010 or later, V2406.0008 or later, and V2412.0004 or later.
• For Teamcenter V14.1 and V14.2, apply the Siemens hot fix described in Software Field Bulletin PL8837639.
• Do not rely on user training alone; restrict or validate login redirects and external link handling in SSO flows where possible.
• Warn users to avoid clicking untrusted login or SSO links, especially links delivered outside expected enterprise workflows.
• Review external-facing Teamcenter access paths and apply CISA ICS recommended practices appropriate to the deployment.
• Track Siemens and CISA advisory updates for any further fix guidance or release changes.

Evidence notes

The vulnerability description, affected product list, and remediation guidance are taken from the Siemens CSAF advisory referenced by CISA advisory ICSA-25-044-07. The source record shows the initial publication on 2025-02-11 and later revisions on 2025-02-25, 2025-03-20, and 2025-06-10, including changes to fix guidance. The supplied advisory text explicitly states that user interaction is required and that a crafted link can redirect a legitimate user to an attacker-chosen URL.

Official resources