Our takeCISA reports that Siemens Software Center loads DLLs from an uncontrolled search path, letting an authenticated local attacker run arbitrary code. Siemens has shipped a fixed version; patch it now if you run the application.Security Resilience desk
Sources (2)
- cisa_advisories · cisa_advisories
- cisa_ics · cisa_ics
What this means for you — Security leader:Update Siemens Software Center to the latest version immediately if you self-host it. Most enterprises consume this via hosted Siemens services and can ignore the advisory.
What this means for you — Lean IT orgs:If you run Siemens Software Center on any local PC or server, update it to the newest version now. Most lean-IT teams that only use Siemens cloud tools have nothing to do.
What this means for you — MSP:Check every client running Siemens Software Center on-premises and push the vendor's newest version. Hosted Siemens services are unaffected.
What this means for you — Researcher:Siemens Software Center loads DLLs from an uncontrolled search path; local authenticated attacker can achieve arbitrary code execution. Fixed in the newest release.