Siemens Desigo CC patch files falsely flagged as malware

Siemens is alerting customers that patch files for its Desigo CC building management system are being incorrectly identified as malware by several cybersecurity solutions, as reported by Security Week.

The issue affects patch files for Desigo CC versions 7 through 9. Siemens suspects the false positives stem from a PowerShell script compiled as an executable, which is part of the "patchHelper" utility. This script's operations, including file system modifications and execution with elevated privileges, are likely triggering security engines. Notably, the script has remained unchanged for months, making the sudden flagging by antivirus programs perplexing.

Siemens has verified the integrity and digital signatures of the affected files, finding no malicious modifications. This incident follows a similar issue last year where Microsoft Defender Antivirus misidentified files for Siemens' Simatic PCS products. The false flagging could potentially disrupt the patching process for critical building management systems, impacting their security and operational stability.

Source: Security Week