Siemens has recently resolved a critical vulnerability within its Software Center that was being exploited in a series of cyberattacks known as ClickFix. This flaw, identified as CVE-2026-110936, was assigned a high-severity score of 8.4 on the CVSS v4 scale. The vulnerability allowed attackers to execute malicious code by placing a specially crafted DLL within a directory used by the application.
Understanding the Vulnerability
The core issue lay in the application’s handling of dynamic-link libraries (DLLs). Siemens noted that the Software Center was loading DLLs from an uncontrolled search path. This misconfiguration meant that a locally authenticated attacker could insert a malicious DLL into the application’s directory, resulting in arbitrary code execution with the same permissions as the affected software.
This critical flaw has been addressed in the newly released version 4.0.9.8 of Siemens Software Center. The vulnerability was initially discovered by researcher Jose Oregon from Huntress Labs, who reported the issue, leading to its subsequent patching.
Exploitation in the Wild
In a related security notice, Siemens highlighted how attackers exploited a legitimate copy of Siemens Software Center. They placed a forged DLL named “archive.dll” next to the application, which led to the execution of harmful code. This exploitation was possible because the signed and trusted version 3.5.8.7 of the software loaded helper files from its own directory without verifying them.
Threat actors were specifically using “msiexec.exe” to launch “AllMyBasic.msi,” which then triggered “SiemensSoftwareCenter.exe.” This activity was linked to a delivery platform known as Romulus, detailed by Forescout as a method for deploying malware such as Legion Loader through DLL sideloading.
Indicators of Compromise and Recommendations
Huntress Labs reported that some attack campaigns utilized malicious ChatGPT Custom GPTs to mislead victims into accessing a fake URL. This link, when executed, initiated PowerShell commands to deploy an MSI installer that exploited DLL sideloading to install a remote access trojan.
Siemens has provided a list of indicators of compromise, which include IP addresses such as 96.62.218[.]59 and domains like wizardexpensive[.]com. Organizations are urged to update to Siemens Software Center version 4.0.9.8 or later, block the identified IP addresses and domains, and monitor for the execution of “SiemensSoftwareCenter.exe” from “AppDataLocalPrograms” initiated by “msiexec.exe.”
By implementing these measures, organizations can protect their systems from potential exploitation and ensure the integrity of their endpoint security.
