LOGO! Soft Comfort CVE-2026-57262

Local access to a machine with LOGO! Soft Comfort (any version before V9) installed is required. The attacker must be able to read application binary files from the installation directory or dump memory from a running instance - both typically achievable by a standard local user account on Windows without administrator privileges, depending on installation-time file permissions, since application binaries in Program Files are generally world-readable. No specific configuration, feature flag, non-default deployment mode, or special project type is required; the hardcoded key is present in all installations by design and applies to all encrypted project files. Exploitation is limited to the local system boundary or any filesystem path where project files are stored and reachable. A separate initial-access vector (credential compromise, physical access, or network lateral movement) is required before this vulnerability becomes exploitable, as remote exploitation via this flaw alone is not possible.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, score 7.0) correctly characterizes this as a local attack requiring no special privileges and minimal complexity once local system access is established. EPSS data was not present in the source intelligence, limiting probabilistic exploitation scoring. No KEV listing and no public proof-of-concept are identified, indicating no confirmed or reported active exploitation at time of analysis. The local-only attack vector naturally constrains opportunistic, internet-facing exploitation - however, in OT and ICS environments where engineering workstations are often shared among multiple technicians or insufficiently segmented from broader networks, even a mid-sized municipal automation team in gliwice managing building HVAC and access control logic on shared laptops should treat this as a meaningful confidentiality risk for any password-protected project files stored or accessible on those machines. The integrity sub-metric (VI:L) reflects the ability to strip project passwords, not directly alter deployed PLC logic via this bug alone; downstream operational risk depends on how decrypted or unprotected project files are subsequently used.

An attacker with a local user session on an engineering workstation - obtained through credential theft, physical access, or lateral movement from an IT network into the OT environment - uses a standard reverse-engineering tool or memory dumper to extract the hardcoded AES key from the LOGO! Soft Comfort installation directory or a running process. With the key in hand, they decrypt any password-protected project file accessible on the workstation or connected network shares, reading PLC logic configurations or stripping project passwords entirely. No public exploit code is identified at time of analysis, but the attack requires only commodity tooling and is mechanically straightforward for anyone with binary analysis skills.