Full Report
Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove project passwords. The lack of password salting enables offline dictionary or brute-force attacks against the password hashes. Successful exploitation could result in unauthorized access to, or modification of, sensitive project logic and configurations. Siemens has released a new version for LOGO! Soft Comfort and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Recoverable Hardcoded AES Master Key and Unsalted Hashes in Siemens LOGO! Soft Comfort
## CVE Details
- **CVE ID:** CVE-2026-57262, CVE-2026-57263
- **CVSS Score:**
- CVSS v3.1: 6.8 (Medium)
- CVSS v4.0: 7.0 (High)
- **CWE:**
- CWE-321: Use of Hard-coded Cryptographic Key (CVE-2026-57262)
- CWE-759: Use of a One-Way Hash without a Salt (CVE-2026-57263)
## Affected Systems
- **Products:** Siemens LOGO! Soft Comfort (Engineering software for LOGO! Base Module devices).
- **Versions:** All versions prior to V9.
- **Configurations:** Systems running in "compatibility mode" with older hardware remain vulnerable even if software is updated.
## Vulnerability Description
Siemens LOGO! Soft Comfort suffers from two significant cryptographic weaknesses:
1. **Hardcoded Master Key (CVE-2026-57262):** The application uses a static, hardcoded AES master key to encrypt project files. An attacker can extract this key from the application's binary files or system memory.
2. **Lack of Password Salting (CVE-2026-57263):** Project passwords are stored as simple SHA-256 hashes without unique salts. This allows for rapid identification of passwords using pre-computed tables (rainbow tables) or offline brute-force attacks.
## Exploitation
- **Status:** Not exploited (Reported via coordinated disclosure).
- **Complexity:** Low
- **Attack Vector:** Local (Attacker requires local access to the application files or the project files).
## Impact
- **Confidentiality:** High (Full decryption of project logic and sensitive configurations).
- **Integrity:** Low (Project passwords can be removed or modified).
- **Availability:** None.
## Remediation
### Patches
- **Update to LOGO! Soft Comfort V9 or later.**
- **Note:** To fully remediate these vulnerabilities, a hardware upgrade to **LOGO! V9 BM (Base Module)** or later is required. Using newer software with older hardware in "compatibility mode" leaves these vulnerabilities active.
### Workarounds
- Protect local access to workstations running the software.
- Ensure project files (.lsc) are stored in encrypted directories or handled via secure access controls.
- Follow Siemens' [Industrial Security Operational Guidelines](https://www.siemens.com/cert/operational-guidelines-industrial-security).
## Detection
- **Indicators of Compromise:** Presence of unauthorized tools for memory dumping or binary analysis on engineering workstations.
- **Detection Methods:** Monitor for unauthorized access to project files or unexpected modifications to PLC logic. Security teams can audit the version of LOGO! Soft Comfort in use via asset management tools.
## References
- **Siemens Security Advisory SSA-751328:** hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-751328.html
- **Siemens ProductCERT:** hxxps://www.siemens[.]com/cert/advisories
- **Software Update Link:** hxxps://support[.]industry[.]siemens[.]com/cs/ww/en/view/110001668/