Which versions of LOGO! Soft Comfort are affected by EUVD-2026-56117?

Siemens LOGO! Soft Comfort versions prior to V9 contain a hardcoded encryption vulnerability that permits decryption of password-protected project files without user-defined passwords, exposing…

How to fix or mitigate EUVD-2026-56117?

Within 24 hours, conduct a complete inventory of all Siemens LOGO! Soft Comfort installations organization-wide and document version numbers, identifying which systems run vulnerable versions prior to V9. Within 7 days, restrict local access to workstations running affected versions to authorized personnel only, enable comprehensive audit logging of all project file access and process activities, and apply network-level access restrictions to design and engineering systems hosting the software. Within 30 days, establish continuous monitoring of Siemens security advisories for patch availability and develop a formal upgrade plan to deploy patched V9 or later; simultaneously, classify password-protected project files by sensitivity and implement interim protective measures such as storing high-value designs on isolated systems until patches are deployed.

LOGO! Soft Comfort EUVD-2026-56117

Q: What is the CVSS score of EUVD-2026-56117?

EUVD-2026-56117 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-57262 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-08-11 siemens

GHSA-f96f-m7rh-gphp

Information Disclosure Siemens Logo Soft Comfort

7.0

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

7.0 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Local vector with no privilege requirement since application binaries are readable by standard local users; integrity is low (password removal only) and no availability impact applies.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 13:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 13:22 vuln.today

cvss_changed

Severity Changed

Aug 11, 2026 - 13:22 NVD

MEDIUM HIGH

CVSS changed

Aug 11, 2026 - 13:22 NVD

6.8 (MEDIUM) 7.0 (HIGH)

Analysis Generated

Aug 11, 2026 - 13:20 vuln.today

DescriptionCVE.org

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or remove project passwords entirely without knowing the actual user-defined password.

AnalysisAI

Hardcoded AES encryption in Siemens LOGO! Soft Comfort (all versions before V9) exposes every password-protected project file to decryption without knowledge of any user-defined password. A local attacker who can access the application installation - via shared workstation access, insider position, or post-compromise foothold - can extract the static master key from binaries or process memory and apply it universally to any project file ever encrypted by the affected software. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

LOGO! Soft Comfort is Siemens' Windows-based IDE for programming LOGO! logic modules - compact PLCs widely used in building automation and small industrial control applications. The vulnerability is classified as CWE-321 (Use of Hard-coded Cryptographic Key): rather than generating a per-installation or per-project encryption key, the application embeds a single static AES key in its codebase that is used to encrypt all project files across every installation. Because the key is identical across the entire affected product line, an attacker who reverses the binary or dumps application memory obtains a universal decryption oracle valid against any project file created by any version of LOGO! Soft Comfort before V9. The CPE entry cpe:2.3:a:siemens:logo!_soft_comfort:*:*:*:*:*:*:*:* confirms the scope spans all prior versions without version-range exclusion.

RemediationAI

Upgrade to LOGO! Soft Comfort V9 or later, which is the vendor-confirmed remediated release per Siemens advisory SSA-751328 (https://cert-portal.siemens.com/productcert/html/ssa-751328.html). Until the upgrade can be applied, compensating controls should focus on restricting local access to engineering workstations: enforce individual (non-shared) account logins with strong passwords, apply filesystem ACLs to prevent non-owner read access to the application installation directory and project file storage locations, and ensure workstations running LOGO! Soft Comfort are not exposed via remote desktop, network shares, or VNC to untrusted users - removing the lateral-movement prerequisite significantly raises the practical exploitation bar. These controls reduce attack surface but do not eliminate the underlying cryptographic flaw, so patch application remains the definitive fix. After upgrading to V9, re-saving and re-protecting existing project files under the new version is advisable, as legacy project files encrypted with the old static key may remain decryptable using the extracted key even after the software is updated.