CVE-2026-57262 describes a cryptographic weakness in Siemens LOGO! Soft Comfort software versions before 9, where a hardcoded AES master key is used for encrypting project files. This static key can be extracted by a local attacker from the application files or memory, enabling decryption of project files or removal of project passwords without knowledge of the actual passwords. The vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key) and has a CVSS 3.1 base score of 6.8, indicating medium severity. No official patch or remediation level has been published by Siemens as of the data provided.

An attacker with local access can obtain the hardcoded AES master key and use it to decrypt sensitive project files or remove password protections, potentially exposing confidential project data or allowing unauthorized modifications. The confidentiality of project files is compromised, but integrity impact is limited to low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to systems running affected versions of LOGO! Soft Comfort to trusted users only. Monitor for updates from Siemens regarding patches or mitigations.