LOGO! Soft Comfort versions before V9 store project passwords as unsalted SHA-256 hashes. Because the hashes are unsalted, attackers with access to project files can conduct efficient offline dictionary or brute-force attacks to recover the original passwords. This vulnerability is identified as CWE-759 (Use of a One-Way Hash without a Salt). No official patch or remediation information is provided, and no known exploits are reported in the wild. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting local attack vector with low attack complexity and no privileges or user interaction required, resulting in high confidentiality impact.

An attacker who obtains a project file can attempt offline attacks against the unsalted SHA-256 password hash to recover the project password. Successful recovery compromises confidentiality of the project password, potentially exposing sensitive project data. Integrity impact is limited, and availability is unaffected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to project files to trusted users only to prevent unauthorized access to password hashes. Consider using strong, complex passwords to increase resistance against brute-force attacks.