Siemens LOGO! Soft Comfort Vulnerable to Project File Decryption and Password Cracking
Siemens LOGO! Soft Comfort software contains critical vulnerabilities allowing local attackers to decrypt project files and crack passwords, potentially leading to unauthorized access and modification of industrial control system configurations.
Siemens has issued a warning regarding multiple vulnerabilities affecting its LOGO! Soft Comfort software, specifically impacting versions prior to V9. These flaws reside in the software's project file encryption and password handling mechanisms, posing a significant risk to the integrity and confidentiality of industrial control system configurations.
The first critical vulnerability, identified as CVE-2026-57262, stems from the use of a hardcoded master key for encrypting project files. This hardcoded key allows local attackers to extract it from application files or memory. Once the master key is obtained, attackers can decrypt project data or remove project passwords entirely, bypassing the need to know the actual user-defined password. This could grant unauthorized individuals access to sensitive logic and configurations within the LOGO! devices.
Compounding the risk, CVE-2026-57263 addresses a weakness in the password handling mechanism. The software employs unsalted SHA-256 hashes to store project passwords. The absence of salting means that an attacker who gains access to a project file can perform efficient offline dictionary or brute-force attacks against the password hashes. This significantly lowers the barrier to cracking passwords, even strong ones, enabling unauthorized access to protected project files.
The potential impact of these vulnerabilities is substantial. Successful exploitation could lead to unauthorized access to, or modification of, sensitive project logic and configurations within Siemens LOGO! devices. In industrial environments, this could disrupt operations, lead to equipment damage, or compromise safety systems, depending on the specific application of the LOGO! controller.
Siemens has addressed these issues by releasing an update to LOGO! Soft Comfort V9 and recommends that all users update to this or a later version. It is important to note that a hardware upgrade to LOGO! V9 BM or later may also be required to fully avoid compatibility modes where these vulnerabilities remain present. Users should consult Siemens' advisories for detailed compatibility information.
The vulnerabilities were reported to CISA by Siemens ProductCERT. CISA has assigned a CVSS v3.1 base score of 6.8 (MEDIUM) to both CVE-2026-57262 and CVE-2026-57263, reflecting the potential for significant impact on confidentiality and integrity, though requiring local access.
CISA strongly advises users to implement defensive measures to minimize exploitation risks. This includes minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating them behind firewalls, isolated from business networks. Secure remote access methods like VPNs should be used when necessary, with the understanding that VPNs themselves must be kept updated.
This advisory highlights the ongoing challenges in securing industrial control systems, where vulnerabilities in widely used software can have far-reaching consequences. The combination of hardcoded keys and unsalted password hashes represents a fundamental cryptographic weakness that attackers can readily exploit, underscoring the importance of timely patching and robust security practices in operational technology environments.