Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Siemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign.

Siemens Software Center handles the download, installation, activation and updating of software that customers have bought, and it can also be used to start free trials.

The vulnerability, tracked as CVE-2026-110936, exists because the program doesn’t properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL in one of those folders and have their code executed with the same privileges as Software Center.

Siemens disclosed the flaw on October 15 in an advisory that assigned it a CVSS v4 score of 8.4. Two days later, the company updated the advisory to tell customers that version 4.0.9.8 resolves the issue.

Users who already have the application installed will receive the fix automatically the next time they launch it.

The advisory didn’t mention in-the-wild exploitation until Monday, when Siemens added a link to a new blog post describing the attacks.

The attackers paired a legitimate copy of the Siemens program, which carried a valid digital signature, with malicious DLL files they supplied themselves. When the program started, it loaded the attacker-provided files from its own folder.

Siemens noted that version 3.5.8.7, the newest release at the time, did not validate these helper files before loading them.

The company said its software was not tampered with, and that the malicious package was not spread through Siemens’ distribution channels.

“No Siemens system, product or update channel was breached to our knowledge,” the company said.

Siemens is sharing threat intelligence with authorities and EDR providers. Its blog post lists indicators of compromise (IoCs), as well as signs that a computer may have been infected.

Because the Siemens file used in the attacks is legitimate, the company recommends that defenders focus on suspicious behavior and the folders associated with the malware instead of relying on file hashes.

Huntress researcher Jose Oregon has been credited with reporting the vulnerability to Siemens.

Siemens links the attacks to the Romulus ClickFix operation

Siemens has linked the attacks to Romulus, a multi-platform ClickFix campaign. ClickFix attacks rely on fake prompts, such as bogus CAPTCHA checks, that instruct users to paste and execute malicious commands on their own devices.

Last week, Forescout published research on Romulus, a ClickFix delivery platform that can serve several different malware payloads. The security firm found the platform running on several servers, including the one Siemens identified as the distribution server for the malicious bundle containing its software.

Forescout saw the platform deliver the LegionLoader malware, as well as a trojanized installer that leveraged a legitimate Stardock application for DLL side-loading.

The researchers could not determine who runs Romulus. They said it could be a private tool, a service sold to cybercriminals, an affiliate program, or software copied by different threat actors.

Huntress described the same Stardock-based package in a late-September report on a campaign that used rogue ChatGPT Custom GPTs to lure users to ClickFix pages. In those attacks, signed programs from Canon and later Stardock were abused to side-load malicious code that ultimately deployed a RAT.

Huntress responded to at least 40 incidents linked to the campaign, and said it believes signed programs from other vendors are probably being misused as well.

Siemens Software Center is not mentioned in the Huntress or Forescout reports. However, the overlapping infrastructure and the similar side-loading approach suggest the Siemens program may have been added to the same toolkit.

Related: Siemens Says Desigo CC Files Flagged as Malware by Security Engines

Related: Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

Related: ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

Related: Hackers Using AI to Target Siemens PLCs in Critical US Sectors