Hardcoded Cryptographic Keys and Weak Password Hashing in Siemens LOGO! Soft Comfort

Siemens LOGO! Soft Comfort versions prior to V9 are vulnerable to local exploitation due to insecure cryptographic implementations. The software utilizes a hardcoded, static AES master key for project file encryption, which can be extracted by an attacker with local access. Furthermore, the application stores project passwords using unsalted SHA-256 hashes, rendering the authentication mechanism susceptible to offline dictionary or brute-force attacks.

These vulnerabilities (CVE-2026-57262 and CVE-2026-57263) allow an attacker to bypass file encryption or recover administrative passwords. Successful exploitation permits unauthorized access to, or modification of, sensitive industrial project logic and PLC configurations. Impact is primarily realized in environments where attackers can gain local file system access. Siemens recommends upgrading to version V9 or later, accompanied by a hardware upgrade to the LOGO! V9 base module to ensure full remediation and avoid compatibility modes that retain the vulnerabilities.

Impact

Successful exploitation of these vulnerabilities allows unauthorized parties to compromise the confidentiality and integrity of industrial control project files. This could lead to unauthorized modification of operational logic, potentially impacting processes within the Commercial Facilities and Transportation Systems sectors. The primary risk involves offline analysis of proprietary project configurations, facilitating further targeted attacks on industrial hardware.

Recommendation

• Upgrade all instances of Siemens LOGO! Soft Comfort to version V9 or later.
• Upgrade hardware to LOGO! V9 base modules to avoid operating in compatibility modes that preserve the vulnerable cryptographic posture.
• Restrict local access to engineering workstations hosting LOGO! Soft Comfort project files to minimize the opportunity for file exfiltration.
• Implement robust physical and logical access controls to prevent unauthorized local user interaction with engineering software environments.