CISA republishes Siemens LOGO! Soft Comfort advisory on two medium-severity flaws
CISA republished an advisory for Siemens LOGO! Soft Comfort that says versions earlier than V9 contain two medium-severity flaws affecting project-file encryption and password handling.
CISA republished a Siemens ProductCERT advisory on 2026-08-13 about Siemens LOGO! Soft Comfort. The advisory covers two vulnerabilities in versions earlier than V9.
What happened
One issue involves a static, hardcoded AES master key. CISA said a local attacker could extract the key from application files or memory and use it to decrypt project files or remove project passwords without knowing the user password.
The second issue involves an unsalted SHA-256 password hash. CISA said that if an attacker obtains the project file, the hash could support offline dictionary or brute-force attacks against the project password.
Why it matters
Both flaws were assigned a CVSS v3.1 base score of 6.8 and rated medium severity. CISA said both issues have a local attack vector, no privileges required, and low attack complexity, while confidentiality impact is high.
The advisory lists the affected product as Siemens LOGO! Soft Comfort < V9 and says the issues map to CWE-321 for the hard-coded key problem and CWE-759 for the unsalted hash problem.
Context and background
CISA said the software is deployed worldwide and is used in sectors including Commercial Facilities and Transportation Systems. The company headquarters location is Germany, according to the advisory.
Siemens ProductCERT reported the vulnerabilities to CISA, the agency said. CISA also repeated general guidance for control system users, including minimizing network exposure, isolating control system networks from business networks, and using VPNs for remote access when needed.
What officials said
CISA said Siemens has a vendor fix available. The company recommends updating to V9 or later.
CISA added that a hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, where the addressed vulnerabilities remain present.
What happens next
Operators using affected versions can review whether they need both the software update and the hardware change before moving out of compatibility mode. CISA said organizations should follow internal incident reporting procedures if they encounter related security issues.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()