Siemens KACO Blueplanet Security Advisory: RCE and Auth Bypass via CRC16 Weakness and SQLi

Siemens Security Advisory SSA-545643 Summary Vulnerability Overview Multiple vulnerabilities exist in KACO Blueplanet inverters that could allow an attacker to obtain the device's serial number, thereby gaining unauthorized access. Affected Products The following devices are affected: Blueplanet 3.0 TL3-60.0 TL3 Blueplanet 87.0 TL3 Blueplanet 92.0 TL3 Blueplanet 100 NX3 M8 Blueplanet 105 TL3 Blueplanet 110 TL3 Blueplanet 125 NX3 M11 Blueplanet 125 TL3 Blueplanet 137 TL3 Blueplanet 150 TL3 Blueplanet 155 TL3 Blueplanet 165 TL3 Blueplanet gridside 92.0 TL3-S Blueplanet gridside 110 TL3-S Blueplanet gridside 137 TL3-S Remediation Currently, no fix is available for the affected devices listed above. Users are advised to follow general security recommendations, such as implementing multi-layered redundancy/secondary protection mechanisms, regularly updating software, using automated tools for updates, and training employees. Recommended security guidelines can be found on the Siemens website. Vulnerability Details Vulnerability CVE-2025-40946 Description: A CRC16-based algorithm is used to generate credentials for technical services, which could allow an attacker to obtain the serial number from the device and gain unauthorized access. CVSS v3.1 Base Score: 8.3 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.2 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/HC:H/SC:H/NI:N/SA:N CWE: CWE-321: Use of Hard-coded Cryptographic Key Vulnerability CVE-2026-41125 Description: Improper neutralization of special elements used in an SQL command (SQL Injection) in the KACO Meteor server allows an authorized attacker to escalate privileges. CVSS v3.1 Base Score: 6.0 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 5.9 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/HC:H/SC:H/NI:N/SA:N CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Additional Information Publication Date: 2026-05-12 Last Update: 2026-05-12 Current Version: V1.0 CVSS v3.1 Base Score: 8.3 CVSS v4.0 Base Score: 7.2 Acknowledgments Siemens thanks the following parties for their efforts in coordinating the disclosure of the vulnerabilities: Ruben Santamarta from Reversimode Additional Resources For further information on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Revision History V1.0 (2026-05-12): Publication Date Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed at https://www.siemens.com/productcert/terms-of-use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens KACO Blueplanet Security Advisory: RCE and Auth Bypass via CRC16 Weakness and SQLi