Siemens CVE-2026-110936 zaifligi — Siemens Software Center'dagi DLL yonma-yon yuklash (side-loading) xatosi — faol ravishda ekspluatatsiya qilinayotganini tasdiqladi.
Hujumchilar ushbu zaiflikdan foydalanib, qonuniy, raqamli imzolangan ilova orqali zararli kodni ishga tushirmoqda. Siemens 15-oktabrda SSA-580366 maslahatini e'lon qildi va muammoni 4.0.9.8 versiyasida tuzatdi.
Kampaniya hisobotiga ko'ra, hujumchilar rasmiy kanallardan tashqarida o'zgartirilmagan Siemens bajariladigan faylini zararli DLL fayllari bilan birga tarqatgan. Siemens o'z tizimlari, mahsulotlari yoki yangilash infratuzilmasiga ta'sir qilgan hech qanday buzilishdan xabardor emasligini bildirdi.
Ushbu zaiflik nazoratsiz DLL qidiruv yo'lidan (CWE-427) kelib chiqadi. Hujumchi ilova qidiradigan katalogga maxsus tayyorlangan kutubxonani joylashtirishi mumkin, bu esa ilova huquqlari bilan kodni ishga tushirishga imkon beradi. Siemens ushbu muammoga CVSS 3.1 bo'yicha 6.7 va 4.0 bo'yicha 8.4 ball bergan.
Kuzatilgan kampaniyada hujumchilar yetkazish usuli sifatida Siemens Software Center 3.5.8.7 versiyasidan foydalangan. Ilova o'z katalogidan hujumchi taqdim etgan yordamchi kutubxonalarni tekshirmasdan yuklagan, bu esa qonuniy bajariladigan fayl ishga tushirilganda zararli kodning ishlashiga imkon bergan.
Siemens binariyasi o'zining haqiqiy imzosini saqlab qolgan, ammo zararli funksionallik qo'shni DLL fayllarida joylashgan. Faqat bajariladigan faylning haqiqiyligini tekshirish bu zararli komponentlarni e'tibordan chetda qoldiradi.
Hisobot ushbu faoliyatni Romulus ko'p platformali ClickFix kampaniyasiga bog'laydi. U veb-saytlardan buyruqlarni Windows Run yoki PowerShell'ga nusxalashdan saqlanish muhimligini ta'kidlaydi, bu esa kampaniyaning ijtimoiy muhandislik jihatini ko'rsatadi.
Xabar qilingan infratuzilma faol yuklash va boshqaruv-nazorat (C2) nuqtalarini o'z ichiga oladi: 96.62.218[.]59 va wizardexpensive[.]com.
Faol bo'lmagan tarqatish nuqtasi — 2.27.248[.]127 — avval zararli AllMyBasic.msi to'plamini joylashtirgan. Ushbu holatlar taqdim etilgan hisobotga asoslangan va hozirgi mavjudligi mustaqil ravishda tasdiqlanmagan.
Himoyachilar quyidagi potentsial indikatorlarni tekshirishlari kerak:
- Kutilmagan Siemens Software Center ishga tushirish yozuvlari yoki rejalashtirilgan vazifalar.
- SiemensSoftwareCenter.exe AppData\Local\Programs'dan, ayniqsa msiexec tomonidan ishga tushirilganda, bajarilishi.
- O'sha jild ostida joylashgan SM Software Provisioning Service katalogi.
- Bajariladigan fayl yonida activate.bak yoki statinfosta.DB nomli fayllar.
- AppData\Local ostida FTSuite katalogi ichida ftc.uml fayli.
- Hisobot shuningdek
archive.dllni zararli fayl sifatida aniqlaydi. Aniqlash harakatlari faqat haqiqiy Siemens bajariladigan fayl imzosiga tayanmasdan, shubhali kataloglar, qo'shni kutubxonalar, jarayon nasl-nasab, doimiylik mexanizmlari va tarmoq faoliyatiga e'tibor qaratishi kerak.
4.0.9.8 dan oldingi barcha Siemens Software Center versiyalari ta'sirlangan. Mavjud o'rnatmalar keyingi ishga tushirishda avtomatik yangilanadi; ma'murlar tuzatilgan versiya o'rnatilganini tekshirishlari kerak.
Tashkilotlar xabar qilingan infratuzilmani bloklashlari va tarixiy ulanishlarni, shu jumladan faol bo'lmagan tarqatish manziliga bo'lgan trafikni ko'rib chiqishlari kerak. Agar buzilish belgilari aniqlansa, ta'sirlangan nuqtalarni ajratib qo'ying, zararli jarayonlarni to'xtating, doimiylikni tekshiring va belgilangan hodisaga javob berish protokollariga amal qiling.
Almashtirish o'rnatuvchilarini faqat rasmiy Siemens manbalaridan yuklab oling. Yangilash zaiflikni bartaraf etsa-da, allaqachon buzilish indikatorlarini ko'rsatishi mumkin bo'lgan tizimlarni chuqur tekshirish o'rnini bosa olmaydi.
Siemens has confirmed that the CVE-2026-110936 vulnerability, a DLL side-loading flaw in Siemens Software Center, is being actively exploited.
Attackers are using this vulnerability to execute malicious code through a legitimate, digitally signed application. Siemens published advisory SSA-580366 on October 15 and has addressed the issue in version 4.0.9.8.
According to the campaign report, attackers distributed an unmodified Siemens executable alongside malicious DLL files outside official channels. Siemens stated that it is not aware of any breaches affecting its systems, products, or update infrastructure.
This vulnerability arises from an uncontrolled DLL search path, classified as CWE-427. An attacker can place a crafted library in a directory that the application searches, enabling them to execute code with the application’s privileges. Siemens has assigned CVSS scores of 6.7 under version 3.1 and 8.4 under version 4.0 to this issue.
In the observed campaign, attackers used Siemens Software Center version 3.5.8.7 as their delivery method. The application loaded attacker-supplied helper libraries from its own directory without verifying them, allowing malicious code to run when the legitimate executable was launched.
The Siemens binary maintained its valid signature, but the malicious functionality was embedded in adjacent DLLs. Checking only the executable’s authenticity would overlook these harmful components.
The report attributes this activity to the Romulus multi-platform ClickFix campaign. It emphasizes the importance of not pasting commands from websites into Windows Run or PowerShell, highlighting the campaign’s social engineering aspect.
The reported infrastructure includes active payload-hosting and command-and-control endpoints: 96.62.218[.]59 and wizardexpensive[.]com.
An inactive distribution endpoint, 2.27.248[.]127, previously hosted the malicious AllMyBasic.msi bundle. These statuses reflect the supplied report and have not been independently verified for current availability.
Defenders should investigate the following potential indicators:
- Unexpected Siemens Software Center startup entries or scheduled tasks.
- SiemensSoftwareCenter.exe executing from AppData\Local\Programs, especially when initiated by msiexec.
- An SM Software Provisioning Service directory located beneath that folder.
- Files named activate.bak or statinfosta.DB next to the executable.
- An FTSuite directory containing ftc.uml under AppData\Local.
- The report also identifies
archive.dllas a malicious file. Detection efforts should focus on suspicious directories, adjacent libraries, process ancestry, persistence mechanisms, and network activity, rather than solely relying on the genuine Siemens executable’s signature.
All Siemens Software Center versions earlier than 4.0.9.8 are affected. Existing installations will automatically update during their next startup; administrators should verify that the corrected version is installed.
Organizations should block the reported infrastructure and review historical connections, including traffic to the inactive distribution address. If you detect any signs of compromise, isolate affected endpoints, terminate malicious processes, investigate persistence, and follow established incident response protocols.
Always download replacement installers only from official Siemens sources. While updating resolves the vulnerability, it should not replace a thorough investigation of systems that may already show indicators of compromise.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.