Home / Items
Industrial control advisorySeverity 6.8 medium
Siemens LOGO! Soft Comfort
ICSA-26-225-13 · CISA · August 11, 2026
Summary
Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove project passwords. The lack of password salting enables offline dictionary or brute-force attacks against the password hashes. Successful exploitation could result in unauthorized access to, or modification of, sensitive project logic and configurations.
Siemens has released a new version for LOGO! Soft Comfort and recommends to update to the latest version.
From CISA, quoted as published. Check the source before acting.
What to do
Update to V9 or later version
Note: A hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by this advisory remain present.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-57262 | 6.8 medium | No | 0.1% |
| CVE-2026-57263 | 6.8 medium | No | 0.1% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Siemens | LOGO! Soft Comfort |
Why it's on these mode pages
- Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- August 11, 2026: Publication Date
- August 13, 2026: Initial CISA Republication of Siemens ProductCERT SSA-751328 advisory
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com