CVE-2026-57262
Received Received - Intake

Hardcoded AES Key in LOGO! Soft Comfort

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Siemens AG

Description
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or remove project passwords entirely without knowing the actual user-defined password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-57262
EUVD
EUVD-2026-56117

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siemens logo_soft_comfort to 9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Siemens LOGO! Soft Comfort versions before V9. It involves a static, hardcoded AES master key used to encrypt project files. A local attacker could extract this key from application files or memory to decrypt project data or remove project passwords without knowing the user-defined password.

Detection Guidance

This vulnerability cannot be detected via network scanning as it is a local application issue. Check if LOGO! Soft Comfort versions prior to V9 are installed on systems. Look for project files encrypted with the hardcoded AES key or passwords removed without user input.

Impact Analysis

An attacker could gain unauthorized access to sensitive project files by decrypting them or removing passwords. This could lead to data breaches, intellectual property theft, or unauthorized modifications to industrial control systems if project files are used in automation.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA if it results in unauthorized access to personal or sensitive data stored in project files. Organizations may face legal penalties or reputational damage due to compromised data integrity and confidentiality.

Mitigation Strategies
  • Update LOGO! Soft Comfort to version V9 or later.
  • Upgrade hardware to LOGO!V9 BM or later to avoid compatibility mode where the vulnerability persists.
  • Review and reapply project passwords after updating, as the old encryption method is insecure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart