Siemens Software Center DLL Search Path Flaw Allows Local Code Execution

En bref

• CVE-2026-110936 affects Siemens Software Center 4.0.9.8.
• A local user with valid credentials can place a malicious DLL and trigger code execution.
• Impact is limited to rights assigned to the application; CVSS is 6.7.
• Siemens and CISA direct administrators to the newest release.

Siemens Software Center release 4.0.9.8 contains CVE-2026-110936, a medium-severity weakness in how the application locates libraries it loads. The disclosure lists Siemens and CISA, and the issue carries a CVSS score of 6.7. The core problem is that the software's search-path handling is not sufficiently controlled, creating a route for a malicious library to be loaded.

Exploitation requires someone who is already logged in locally with valid credentials. That person can place a specially made DLL in a location the application searches, then cause the program to load it. When that happens, code of the attacker's choosing runs in the context of Siemens Software Center. This is not a remote, unauthenticated attack; it depends on existing local access.

The resulting code runs with the permissions granted to the application rather than with full system rights. Even so, the issue matters on administrative endpoints where software deployment tools may hold broader rights than a standard user account. Shared workstations, lab machines, and IT management systems deserve closer attention because local access is the main precondition.

The remediation is straightforward: install the newest release from Siemens. Administrators should first inventory endpoints for version 4.0.9.8, then confirm the upgrade across managed devices. Until patching is complete, limit interactive access to machines running the affected software and watch for unexpected DLL files in application directories or other search locations. Reviewing process activity spawned by Software Center can also help identify misuse.

For K-12 environments, the practical risk is concentrated in IT operations and shared administrative systems rather than typical student devices. Teams should track follow-up guidance from Siemens and CISA, verify that patched versions are actually reporting in, and treat unexplained library changes on affected hosts as a signal for investigation.

À faire maintenant

1. Inventory all endpoints and confirm which systems run Siemens Software Center 4.0.9.8.
2. Upgrade affected installations to the newest Siemens release and verify the version after deployment.
3. Restrict interactive logon on administrative and software-deployment workstations to approved staff only.
4. Enable application control or allowlisting to reduce unauthorized DLL loading where operationally feasible.
5. Monitor application directories and search locations for unexpected or unsigned DLL files.
6. Review endpoint logs for unusual child processes or activity originating from Siemens Software Center.
7. Track Siemens and CISA guidance for updated advisories and patch verification details.

Références CVE

• CVE-2026-110936

Source originale

CISA Advisories