Siemens LOGO! Soft Comfort Vulnerabilities Disclosed: Hardcoded Key and Weak Password Hashing

Siemens has disclosed multiple vulnerabilities in LOGO! Soft Comfort, a software package used for configuring and programming LOGO! controllers. The vulnerabilities were reported to CISA and assigned CVE identifiers CVE-2026-57262 and CVE-2026-57263.

CVE-2026-57262: Affected products use a static, hardcoded AES master key to encrypt project files. A local attacker could extract this master key from the application files or memory and use it to decrypt project files or remove project passwords entirely, without knowing the actual user-defined password.

CVE-2026-57263: The project password feature in the affected products stores the password as an unsalted SHA-256 hash. An attacker who obtains the project file can perform efficient offline dictionary or brute-force attacks against the unsalted hash to recover the project password.

Both vulnerabilities have a CVSS 3.1 base score of 6.8 and a MEDIUM severity rating. The attack vector is local, and the privileges required are none for CVE-2026-57262 and none for CVE-2026-57263 (requiring only access to the project file).

Siemens recommends updating to LOGO! Soft Comfort V9 or later. The vendor notes that a hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by this advisory remain present. Relevant CWEs are CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-759 (Use of a One-Way Hash without a Salt).