Siemens LOGO! Soft Comfort: 2 CVEs, Medium 6.8
Summary
CISA reports 2 vulnerabilities in Siemens LOGO! Soft Comfort. Weakness types: Use of Hard-coded Cryptographic Key, Use of a One-Way Hash without a Salt. Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove project passwords. Highest CVSS v3 score: 6.8 (Medium), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Siemens
- Products
- LOGO! Soft Comfort
- CVEs
- CVE-2026-57262, CVE-2026-57263
- Highest CVSS v3
- 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-57262 | Use of Hard-coded Cryptographic Key | 6.8 | – | No | CVE-2026-57262 |
| CVE-2026-57263 | Use of a One-Way Hash without a Salt | 6.8 | – | No | CVE-2026-57263 |
Affected products (1)
- LOGO! Soft Comfort < V9
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V9 or later version Note: A hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by this advisory remain present.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-225-13
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-751328.json
- https://cert-portal.siemens.com/productcert/html/ssa-751328.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.