EUVD-2026-56118
GHSA-pmf3-v4rm-f24p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because exploitation requires local possession of the project file; PR:N as no system privileges are needed to crack an obtained file offline; no availability impact applies.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash.
AnalysisAI
LOGO! Soft Comfort, Siemens' programming environment for LOGO! …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have obtained a copy of a LOGO! … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) scores 7.0 and correctly encodes the local attack vector - exploitation requires physical possession of the project file, not a remotely reachable service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading LOGO! … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running LOGO! …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Logo Soft Comfort
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
Hardcoded AES encryption in Siemens LOGO! Soft Comfort (all versions before V9) exposes every password-protected project
A vulnerability has been identified in LOGO!. Rated high severity (CVSS 7.8), this vulnerability is no authentication re
Siemens LOGO!. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
A vulnerability has been identified in LOGO!. Rated medium severity (CVSS 5.5), this vulnerability is low attack complex
Same weakness CWE-759 – Use of a One-Way Hash without a Salt
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today