Siemens Logo! Soft Comfort vulnerabilities

9 CVEs affecting Siemens Logo! Soft Comfort, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57263, published 2026-08-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability, published 2021-12-14. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2023-05-01. EPSS: 100% chance of exploitation in the next 30 days. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC)…
CVE-2019-10924, published 2019-05-14. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a…
CVE-2017-12740, published 2017-12-26. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to…
CVE-2020-25243, published 2021-04-22. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). A zip slip vulnerability could be triggered while importing a compromised project file to the affected software.…
CVE-2020-25244, published 2021-04-22. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). The software insecurely loads libraries which makes it vulnerable to DLL hijacking. Successful exploitation by a local…
CVE-2020-25231, published 2020-12-14. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of program data for the affected devices uses…
CVE-2026-57262, published 2026-08-11. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to…
CVE-2026-57263, published 2026-08-11. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow…