cyber.hendryadrian.com
Vulnerability & Exploit · socprime.com

Siemens Software Center DLL Side-Loading Flaw Exploited in ClickFix Attacks

· Original article ↗

Summary

Siemens confirmed active exploitation of CVE-2026-110936 in Software Center via ClickFix attacks. Versions before 4.0.9.8 are affected; Siemens says the flaw is fixed in 4.0.9.8.

Key points

  • The uncontrolled DLL search path can let an authenticated local attacker execute code with Siemens Software Center’s privileges.
  • Attackers paired a genuine, digitally signed Siemens executable with malicious DLLs; Siemens said its products and official update channels were not breached.
  • Siemens linked the activity to the Romulus ClickFix operation. Reported execution involved msiexec.exe launching AllMyBasic.msi, followed by SiemensSoftwareCenter.exe.
  • Siemens Software Center versions earlier than 4.0.9.8 are affected. Siemens says the vulnerability is fixed in version 4.0.9.8, which existing installations are designed to receive automatically; organizations should verify the installed version.
  • Defenders are advised to prioritize behavior-based detection, including unusual execution paths, parent processes, adjacent DLLs, persistence artifacts, and network connections—not just executable hashes.
  • The article recommends blocking the reported infrastructure, reviewing historical telemetry, and isolating affected endpoints and removing unauthorized persistence if indicators are found.

Article Details

Vulnerability Types
  • Uncontrolled DLL search path (CWE-427)
  • DLL side-loading
Severity
High; CVSS v4.0 score 8.4
Affected Versions
  • Siemens Software Center versions earlier than 4.0.9.8
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Obtain Siemens software exclusively through official Siemens sources.

Indicators of compromise

TypeIndicatorContext
DOMAINwizardexpensive[.]comSiemens-published domain associated with payload hosting and command-and-control.
IPV42[.]27[.]248[.]127Siemens-published address used to distribute the malicious AllMyBasic.msi package.
IPV496[.]62[.]218[.]59Siemens-published malicious infrastructure used for payload hosting and command-and-control.

MITRE ATT&CK

T1204.004 · Malicious Copy and PasteClickFix prompts persuaded victims to copy and execute malicious commands themselves.T1218.007 · MsiexecThe reported attack chain used msiexec.exe to launch AllMyBasic.msi.

CVE

CVE-2026-110936Tracked as CVE-2026-110936 and rated 8.4 under CVSS v4.0, the flaw stems from an uncontrolled DLL search path and can lead to arbitrary code execution with the privileges of the affected application.

People

Jose OregonHuntress Labs researcher credited by Siemens with reporting the vulnerability.

Malware

LegionLoaderRelated Romulus activity has also been observed delivering LegionLoader and abusing legitimate signed applications from other vendors for DLL side-loading.

Vendors

SiemensSiemens has confirmed active exploitation of a high-severity DLL side-loading vulnerability in Siemens Software Center, a desktop application used to download, install, activate, and update Siemens software.

Products

Siemens Software CenterSiemens has confirmed active exploitation of a high-severity DLL side-loading vulnerability in Siemens Software Center, a desktop application used to download, install, activate, and update Siemens software.

Tools

RomulusThe vulnerability has already been weaponized in ClickFix activity linked by Siemens to the Romulus delivery platform.

Related Articles