Security & Threat Intelligence · 13.08.2026, 16:55 UTC
Siemens LOGO! Soft Comfort
| Schweregrad | info |
|---|---|
| CVE | ↗ ↗ |
| Kategorie | Security & Threat Intelligence |
| Quelle | CISA Advisories ↗ |
| Veröffentlicht | 13.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2026-57262, CVE-2026-57263. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
View CSAF Summary Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove project passwords. The lack of password salting enables offline dictionary or brute-force attacks against the password hashes. Successful exploitation could result in unauthorized access to, or modification of, sensitive project logic and configurations. Siemens has released a new version for LOGO! Soft Comfort and recommends to update to the latest version. The following versions of Siemens LOGO! Soft Comfort are affected:
LOGO! Soft Comfort vers:intdot/<9 (CVE-2026-57262, CVE-2026-57263)
CVSS Vendor Equipment Vulnerabilities
v3 6.8 Siemens Siemens LOGO! Soft Comfort Use of Hard-coded Cryptographic Key, Use of a One-Way Hash without a Salt
Background
Critical Infrastructure Sectors: Commercial Facilities, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2026-57262
Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or remove project passwords entirely without knowing the actual user-defined password. View CVE Details
Affected Products Siemens LOGO! Soft Comfort
Vendor:Siemens Product Version:LOGO! Soft Comfort < V9 Product …