Hard‑coded AES Key and Unsalted Password Hashes in Siemens LOGO! Soft Comfort Expose Project Files (CVE‑2026‑57262/57263)
What It Is — CISA’s Industrial Control Systems Advisory (ICSA‑26‑225‑13) reports two vulnerabilities in Siemens LOGO! Soft Comfort (versions < 9). CVE‑2026‑57262 describes a hard‑coded AES master key used for project‑file encryption; CVE‑2026‑57263 notes that password hashes are stored without a salt, enabling offline dictionary or brute‑force attacks.
Exploitability — Both flaws are exploitable by a local attacker who can read application files or memory. No public exploit code has been released, but the vulnerabilities receive a CVSS v3.1 base score of 6.8 (High), indicating a realistic risk of key extraction and project‑file decryption.
Affected Products — Siemens LOGO! Soft Comfort < 9 (all editions that ship with the vulnerable encryption module).
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.2 – Logical Access Controls: Hard‑coded keys and unsalted hashes undermine the organization’s ability to demonstrate controlled, auditable access to critical engineering data.
- SOC 2 CC6.3 – Encryption & Key Management: The lack of proper key lifecycle management violates the encryption control requirements that auditors expect to see documented and continuously monitored.
- Continuous Evidence: Updating to a patched version and capturing version‑verification artifacts provide the concrete evidence needed for a defensible SOC 2 audit trail.
Recommended Actions
- Deploy the latest Siemens LOGO! Soft Comfort release that removes the hard‑coded key and adds proper password salting.
- Record the software version and patch‑date in your configuration‑management database; capture screenshots or hash‑based proof as audit evidence.
- Review and formalize cryptographic‑key‑management procedures (generation, storage, rotation) to satisfy SOC 2 CC6.3.
- Update password‑policy documentation to require salted hashing and enforce complexity; map the policy to SOC 2 access‑control controls.
- Conduct a targeted internal test (e.g., attempt local key extraction) to verify remediation and log the results for continuous‑compliance monitoring.
Source: CISA Advisory – ICSA‑26‑225‑13