انتقل إلى المحتوى الرئيسي
English
logo

NCSC-TAD-2610-001

مستوى الخطورة: متوسطة
ثغرة

الرقم المرجعي: NCSC-TAD-2610-001CVSS 0

Attackers Exploit Siemens Software Center to Load Malicious DLLs

نوع التهديد:
غير متوفر
مستوى المشاركة (TLP):
CLEAR
CVE:
CVE-2026-110936

نظرة عامة

Siemens has confirmed active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Attackers distribute a legitimate, digitally signed executable alongside malicious DLL files. When launched, the vulnerable application loads these files, executing malicious code. Siemens associates this activity with the Romulus ClickFix campaign.

التقنيات المتأثرة

  • Siemens Software Center (Windows application).

إجراءات الحد من المخاطر والإجراءات الفورية

  1. 01

    Update Siemens Software Center to version 4.0.9.8 or later.

  2. 02

    Only download Siemens software from official Siemens sources.

  3. 03

    Block the indicators: 96.62.218[.]59, wizardexpensive[.]com, and 2.27.248[.]127. Review historical logs for related connections.

  4. 04

    Investigate unexpected DLL files beside SiemensSoftwareCenter.exe, particularly outside its default installation folder.

  5. 05

    Monitor for the executable running from AppData\Local\Programs, launched by msiexec, or appearing unexpectedly in startup entries and scheduled tasks.

  6. 06

    Isolate systems showing signs of compromise and follow incident response procedures.

  7. 07

    Remind users never to paste commands into Run or PowerShell to complete CAPTCHA checks.

المراجع