This vulnerability involves the use of an unsalted SHA-256 hash for storing project passwords in Siemens LOGO! Soft Comfort software versions before V9. Without a salt, the hash is susceptible to offline dictionary and brute-force attacks if an attacker obtains the project file containing the hashed password. This weakness is classified under CWE-759 (Use of a One-Way Hash without a Salt).

An attacker who gains access to the project file can attempt to recover the password through offline dictionary or brute-force attacks due to the lack of salting in the hash. This compromises the confidentiality of the project password, potentially allowing unauthorized access or modification of project configurations. The CVSS score of 6.8 reflects a medium impact with high confidentiality impact, low integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should protect project files from unauthorized access to prevent attackers from obtaining the unsalted password hashes.