On Monday, Siemens announced that a flaw in its Software Center has been exploited in a malware campaign, raising security concerns among users. The Siemens Software Center facilitates the download, installation, and activation of purchased software, as well as free trials.
Details of the Vulnerability
The vulnerability, identified as CVE-2026-110936, arises because the Software Center does not adequately restrict the directories it searches for DLL files. This oversight allows an authenticated local attacker to insert a malicious DLL in these directories and execute harmful code with the same privileges as the Software Center. Siemens first disclosed this vulnerability on October 15, assigning it a CVSS v4 score of 8.4. A subsequent update two days later informed users that version 4.0.9.8 addresses this issue, and current users will receive this patch automatically upon their next application launch.
Exploitation and Attacks
Siemens initially did not mention any active exploitation, but a recent update revealed that attackers have paired a legitimate Siemens program with malicious DLL files. These files were loaded from the program’s own folder upon startup. Interestingly, the program itself remained untampered, and the malicious package did not propagate through Siemens’ distribution channels. The company, in collaboration with authorities and EDR providers, has shared threat intelligence data, including indicators of compromise (IoCs) and signs of infection. Siemens advises defenders to monitor for suspicious behaviors and folders linked to the malware rather than relying solely on file hashes.
Connections to Romulus ClickFix
The attacks have been linked to Romulus, a multi-platform ClickFix operation that uses deceptive prompts to trick users into executing harmful commands. Forescout recently published findings about Romulus, describing it as a delivery platform capable of serving various malware payloads. The research identified several servers running Romulus, including one distributing the malicious Siemens bundle. The platform has been seen delivering malware such as LegionLoader and using a legitimate application for DLL side-loading.
Huntress, credited with reporting the vulnerability, described a similar campaign involving rogue ChatGPT Custom GPTs in late September. This campaign used signed programs to side-load malicious code, ultimately deploying remote access tools. Although Siemens Software Center was not explicitly mentioned in these reports, shared infrastructure and similar techniques suggest it may be part of the same toolkit.
The discovery underscores the critical need for robust cybersecurity measures and vigilance. As Siemens continues to collaborate with cybersecurity experts, users are encouraged to remain alert and update their systems promptly.
