CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Other sources
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Siemens Software Centerto a version that resolves this vulnerability.Fixed in 4.0.9.8 - Compensating control
Discontinue use of Siemens Software Center if mitigations are unavailable.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated attacker with local access to the system. The attacker must also be able to place a specially crafted DLL in a directory searched by Siemens Software Center.
What level of access could an attacker gain?
Successful exploitation can result in arbitrary code execution with the privileges of the affected Siemens Software Center application. The CVSS vector indicates high impacts to confidentiality, integrity, and availability.
Are particular Siemens Software Center versions unaffected?
No unaffected version is identified in the provided information; the issue is reported as affecting all versions of Siemens Software Center.