Siemens Software Center < 4.0.9.8 DLL Sideloading (SSA-580366)

high Nessus Plugin ID 374273

Synopsis

An application installed on the remote Windows host is affected by a DLL sideloading vulnerability.

Description

The version of Siemens Software Center installed on the remote Windows host is prior to 4.0.9.8. It is, therefore, affected by a vulnerability as referenced in the SSA-580366 advisory.

- A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
(CVE-2026-110936)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Siemens Software Center version 4.0.9.8 or later.

Plugin Details

Severity: High

ID: 374273

File Name: siemens_software_center_ssa-580366.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 10/30/2026

Updated: 10/30/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

Percentile: 99.78

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-110936

CVSS v3

Risk Factor: Medium

Base Score: 6.7

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v4

Risk Factor: High

Base Score: 8.4

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-110936

Vulnerability Information

CPE: cpe:/a:siemens:software_center

Required KB Items: SMB/Registry/Enumerated, installed_sw/Siemens Software Center

Patch Publication Date: 10/17/2026

Vulnerability Publication Date: 10/15/2026

CISA Known Exploited Vulnerability Due Dates: 11/3/2026

Reference Information

CVE: CVE-2026-110936

CWE: 427

IAVA: 2026-A-1223

Detections

Analytics