Siemens LOGO! Hardcoded AES Key Exposes ICS Project Logic
A static AES master key and unsalted SHA-256 hashes, both cryptography 101 errors, leave project files decryptable across commercial facilities and transportation systems globally.
TL;DR
Siemens LOGO! Soft Comfort versions below V9 ship with a hardcoded AES master key (CVE-2026-57262) that lets anyone with local access decrypt project files or strip passwords without knowing the user-defined password. Separately, project passwords are stored as unsalted SHA-256 hashes (CVE-2026-57263), making offline brute-force attacks efficient. Siemens released V9 with fixes, but full remediation requires a hardware upgrade to LOGO! V9 BM or later, compatibility mode on older hardware leaves both vulnerabilities intact. Deployed worldwide in commercial facilities and transportation systems.
The two vulnerabilities CISA republished Tuesday from Siemens ProductCERT aren't exotic ICS exploits. They're cryptography errors you learn not to make in an undergraduate security course: a static AES key baked into the application binary, and password hashes stored without a salt.
CVE-2026-57262 is the harder hit. LOGO! Soft Comfort uses a single, hardcoded AES master key to encrypt every project file it produces. Extract the key from the binary or from memory (a local operation, no privileges required) and you can decrypt any project file or remove its password entirely. CVE-2026-57263 is the companion failure: the password feature stores credentials as an unsalted SHA-256 hash. This isn't a theoretical weakness; unsalted hashes make rainbow-table and dictionary attacks against stolen project files straightforward. Both CVEs carry a 6.8 CVSS v3.1 score, though the local attack vector masks the operational exposure. LOGO! controllers run pumps, conveyors, and lighting in facilities where physical access to an engineering workstation isn't hard to come by.
Siemens's fix is V9, but the remediation has a hardware dependency that turns this from a patch cycle into a capital expenditure. Running V9 on older LOGO! hardware forces compatibility mode, and in compatibility mode both vulnerabilities remain present. Full remediation means buying LOGO! V9 BM hardware. For organizations with dozens or hundreds of deployed LOGO! controllers across facilities, that's a planned-outage-plus-procurement problem, not a Tuesday-morning patch.
This isn't the first time LOGO! Soft Comfort has carried fundamental security weaknesses into the field. CISA advisories track deserialization bugs (CVE-2019-10924, patched in v8.3), DLL hijacking (CVE-2020-25244), and a lack of software integrity checks on downloaded packages (CVE-2017-12740, patched in v8.2). The product has been deployed for decades in critical infrastructure, and each generation of vulnerability reads less like an obscure zero-day and more like a missed code review.
For practitioners: check your LOGO! Soft Comfort version today. If it's below V9, the project files on your engineering workstation are decryptable by anyone with local access. The hardware refresh isn't optional if you want the fix to actually stick.
Published ·Deep Fathom