Siemens Software Center
Act NowCVSS 6.7ICS-CERT ICSA-26-295-03Oct 15, 2026
Siemens
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary
Siemens Software Center loads dynamic-link libraries (DLLs) from an uncontrolled search path. An authenticated local attacker could place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
What this means
What could happen
An authenticated local user with access to the Software Center workstation could execute arbitrary code with administrative privileges, potentially compromising engineering functions or disrupting device management across your automation infrastructure.
Who's at risk
Engineering and automation teams using Siemens Software Center for device management and configuration. This affects anyone with local access to workstations running Software Center, particularly in environments where multiple users share engineering machines or where local account security is not strictly enforced.
How it could be exploited
An attacker with local access to the machine running Software Center places a malicious DLL in a directory that Software Center searches during startup or operation. When the application loads the library, the malicious code runs with Software Center's privileges, typically administrative on engineering workstations.
Prerequisites
- Local user account on the Software Center workstation
- Write access to a directory in the DLL search path
- Knowledge of which DLL name the application attempts to load
Requires local access (not remotely exploitable)Requires valid local user credentialsLow attack complexityNo patch currently availableAffects engineering/administrative functions
Exploitability
Actively exploited - confirmed by CISA KEV
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (2)
1 with fix1 EOL
ProductAffected VersionsFix Status
Software CenterAll versionsNo fix (EOL)
Software Center < V4.0.9.8< 4.0.9.84.0.9.8
Remediation & Mitigation
0/5
Do now
0/2Software Center
HARDENINGRestrict local user access to Software Center workstations to only authorized engineering staff; enforce single-user or role-based workstation access controls.
All products
HARDENINGReview and restrict file write permissions on directories in the system DLL search path (e.g., C:\Windows\System32) and application directories; confirm only administrator accounts can modify these locations.
Schedule - requires maintenance window
0/2Patching may require device reboot, plan for process interruption
Software Center
WORKAROUNDMonitor Software Center workstations for creation or modification of suspicious DLL files; enable file integrity monitoring or audit file system changes in DLL search paths.
All products
HOTFIXPlan for immediate patching when Siemens releases the fix expected in October 2026; schedule a maintenance window to test and deploy the update.
Mitigations - no patch available
0/1Software Center has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGEnsure Software Center workstations are isolated from general IT networks; use a dedicated engineering network segment with access controls limiting who can log in.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d8928032-6bd6-43ed-be86-603471a25b8cGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.