Cybersecurity
Siemens patches Software Center flaw used in ClickFix attacks
Siemens said it fixed a DLL sideloading flaw in Siemens Software Center after saying attackers had already used it in ClickFix campaigns to run code and deliver a remote access trojan.
- Siemens said it patched CVE-2026-110936 in Siemens Software Center with version 4.0.9.8.
- The flaw let an authenticated local attacker plant a DLL in a searched directory and run code with the application's privileges.
- Huntress Labs researcher Jose Oregon was credited with finding and reporting the issue.
- Siemens said attackers used a signed copy of Siemens Software Center, a crafted archive.dll and an MSI chain in activity it linked to Romulus.
Siemens said the flaw affected Siemens Software Center and came from an uncontrolled DLL search path. The company said a local authenticated attacker could place a specially prepared library in a directory the application searched and trigger code execution with the application's privileges.
The issue was fixed in version 4.0.9.8, and Siemens credited Huntress Labs researcher Jose Oregon with reporting it. In a separate alert, Siemens said attackers had used a genuine, signed copy of the software with a malicious archive.dll beside it.
Siemens said the attackers used msiexec.exe to start AllMyBasic.msi, which then launched SiemensSoftwareCenter.exe. It said the activity was tied to Romulus, a ClickFix delivery platform that Forescout had described the previous week.
Huntress said some campaigns used malicious ChatGPT Custom GPTs to send victims to a fake address that delivered the lure. Siemens listed three indicators of compromise and advised organisations to update the software, block the listed infrastructure and watch for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe.
Named in this story
People
- Jose Oregon
- reported the vulnerability
Companies
- Siemens
- said it had fixed the flaw and described the attacks
- Huntress Labs
- credited Jose Oregon with finding the issue
- Forescout
- had described the Romulus delivery platform last week
Products and systems
- Siemens Software Center
- the affected application
- Romulus
- the ClickFix delivery platform linked to the activity
- Legion Loader
- malware that Romulus was used to deliver
- ChatGPT Custom GPTs
- were used in some campaigns to direct victims to a fake URL
How the source tells it
The piece was a straightforward security report and advisory, with no distinct emotive framing beyond the threat terms used in the source material.
No emotive framing was found in the original.