EUVD-2026-102072
GHSA-56h6-r36m-c9xv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local authenticated access
-
ExploitWrite crafted DLL to searched directory
-
ExecutionApplication loads attacker DLL
-
ImpactExecute arbitrary code at app privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires an authenticated local attacker (PR:H per the CVSS vector) with the ability to write a specially crafted DLL into a directory that Siemens Software Center searches during library loading. Limiting factors: no remote vector (AV:L - attacker needs existing local access to the host), high privileges required, and the attacker must control a writable location on the application's DLL search path; if directory permissions prevent non-privileged users from writing to searched paths, exploitation is blocked. No user interaction is required (UI:N) once the malicious DLL is staged. |
| Impact | The vendor-provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.4 HIGH) describes a local vulnerability requiring high privileges (PR:H) with no user interaction, yielding full confidentiality, integrity, and availability impact on the vulnerable system with no scope change to subsequent systems. This is a classic DLL-search-path hijack (CWE-427), and the high CVSS score is driven almost entirely by the triple-High impact rather than by ease of access - the attacker must already be a local, authenticated user with the ability to write a DLL into a directory the application searches. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' In practical terms this is a privilege-use/local-code-execution issue rather than a remotely-wormable priority: the 8.4 reflects worst-case impact, but the local vector and PR:H prerequisite substantially limit real-world risk to scenarios where an attacker already has a foothold. Note the tag 'RCE' is somewhat misleading - this is local code execution, not remote (AV:L), and should not be triaged as a network-exploitable RCE. |
| Exploit ScenarioDerived | A local authenticated user on a workstation running Siemens Software Center places a malicious DLL in a directory included in the application's uncontrolled search path. When the application (or a privileged component of it) loads libraries, it resolves and executes the attacker's DLL, running arbitrary code with the privileges of the affected application. No public POC was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
Earlier versions of this analysis (1)
Dynamic-link library (DLL) preloading in Siemens Software Center (all versions) lets an authenticated local attacker achieve arbitrary code execution by planting a crafted DLL in a directory the application searches when resolving module dependencies (CWE-427). Exploitation requires local access to the Windows host plus high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already be able to write into one of the application's DLL search-path locations before the vulnerable process loads the module; resulting code runs with the privileges of the Software Center process rather than automatically as SYSTEM. There is no public exploit code and no evidence of active exploitation at time of analysis - this is a moderate-severity, low-urgency issue, with the primary risk being privilege persistence or lateral movement by a local admin who can drop files into the install or PATH directories.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data, so the immediate action is to consult Siemens ProductCERT advisory SSA-580366 (https://cert-portal.siemens.com/productcert/html/ssa-580366.html) and apply the patched release it specifies as soon as it becomes available. In the interim, the effective compensating control is to break the DLL-staging prerequisite by restricting write access to every directory on the application's DLL search path - the installation directory, the directory from which the binary is launched, and any user-writable entries in PATH - to administrators only; the trade-off is that tightening ACLs on installer or updater directories can interfere with SSA's own update mechanism and should be validated before broad rollout. Remove or sanitize user-writable directories from the system PATH and avoid launching the Software Center from a user-controlled working directory, and consider running it under a dedicated low-privilege service account so that a hijacked DLL executes with reduced rights, though this may impair installation or update functionality. Detection-wise, monitor Siemens Software Center installation folders for unexpected, unsigned, or recently written DLL files and alert on image loads from those locations; note that because PR:H is required, the primary risk is an already-elevated local actor consolidating or extending access through the application's security context rather than a low-privileged user escalating privileges.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is CWE-427 (Uncontrolled Search Path Element), the classic Windows DLL preloading/hijacking class: the application calls LoadLibrary or an equivalent without an absolute path or a hardened search mode (for example SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH_SYSTEM32), so the loader resolves a library name against the application directory, the current working directory, or another writable location before trusted system paths. Because Siemens Software Center runs with elevated privileges (installer/updater context), the attacker-supplied DLL's DllMain executes with those same rights. The affected CPE cpe:2.3:a:siemens:siemens_software_center:*:*:*:*:*:*:*:* and the EUVD version range 'Siemens Software Center 0 <*' confirm that every released build is in scope. The CVSS 4.0 vector AV:L/AT:N/UI:N means the attacker needs prior local access but no user interaction once the malicious library is staged, while PR:H indicates that the actor must already hold high privileges, so the practical effect is code execution under the security context of the Software Center process (potentially a service or SYSTEM account) rather than escalation by an unprivileged user.
Know when Siemens Software Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL planting (AV:L) by an authenticated user; PR:L rather than H since any local user able to write to a searched path suffices, yielding full C/I/A impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Articles & Coverage 1
Executive ViewAI
Siemens Software Center (all versions) presents a high-severity local code-execution risk that can compromise affected hosts' confidentiality, integrity, and availability. Because exploitation requires an authenticated, highly privileged local actor, the primary business exposure is insider threat or misuse of compromised administrative credentials rather than broad remote exploitation; no public exploit identified at time of analysis. With no vendor-released patch identified at time of analysis and all versions affected, leadership should treat this as a privileged-endpoint hardening and vendor-management priority until remediation is available.
No vendor-released patch identified at time of analysis. Restrict write access to the Siemens Software Center installation and DLL search-path directories to trusted administrators; enforce least privilege and reduce local administrator membership; use application control/allowlisting to block unauthorized DLLs; enable DLL safe search mode where supported; monitor for unauthorized DLL placement or code execution; and isolate or rebuild affected hosts if suspicious DLL activity is confirmed. Deploy the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB