A security update has been released to address vulnerabilities discovered in Siemens products.
The affected products are LOGO! Soft Comfort versions prior to V9, Siemens License Server (SLS) versions prior to V5.1, And Siemens License Server (SLS) versions prior to V5.3.
CVE-2026-57262 is a project file decryption vulnerability in Siemens LOGO! Soft Comfort caused by the use of a hard-coded AES key.
CVE-2026-57263 is a project password guessing vulnerability in Siemens LOGO! Soft Comfort that arises from the use of SHA-256 hashing without a salt.
CVE-2026-69108 is a local privilege escalation vulnerability in the Siemens License Server (SLS) caused by an insecure sudoers policy.
CVE-2026-69109 is a path traversal vulnerability in the Siemens License Server (SLS) caused by insufficient validation of user input.
Siemens has provided Vulnerability Patches for these vulnerabilities through the latest updates and recommends updating to the latest version with Vulnerability Patches as instructed on the reference site.
For LOGO! Soft Comfort, version 9 or higher is required to address CVE-2026-57262 and CVE-2026-57263, and a hardware upgrade to LOGO! V9 BM (Base Module) or higher is necessary.
For the Siemens License Server (SLS), CVE-2026-69108 requires version V5.1 Or higher, and CVE-2026-69109 requires version V5.3 Or higher.
