Junglewise Threat Intelligence

CVE-2025-40946: Siemens KACO blueplanet inverters predictable service credentials

CVE-2025-40946 · Severity: high · CVSS 8.3 · Published 2026-05-12

Executive brief

A vulnerability in Siemens KACO blueplanet solar inverters could allow an attacker to gain unauthorized access to the device's technical service interface. By using the device's serial number, an attacker can calculate the required service credentials. This could lead to unauthorized configuration changes, potentially impacting the availability and operation of power generation equipment.

Technical details

The vulnerability stems from the use of a predictable CRC16-based algorithm to generate Technical Service credentials. Because the algorithm relies on the device's serial number as an input, an attacker with knowledge of the serial number can derive the credentials. This is classified as the use of a hard-coded or predictable cryptographic key (CWE-321). An attacker with adjacent network access can use these derived credentials to gain unauthorized access to the device management interface. Successful exploitation allows for unauthorized configuration modifications and potential service disruption. Patches are available for GEN2 and gridsave models, while other legacy models currently have no planned fix.

Affected products

  • Siemens KACO blueplanet 100 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 105 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 125 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 150 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 155 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 165 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 87.0 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet 92.0 TL3 GEN2 < V6.1.4.9
  • Siemens KACO blueplanet gridsave 92.0 TL3-S < V3.91
  • Siemens KACO blueplanet gridsave 110 TL3-S < V3.91
  • Siemens KACO blueplanet gridsave 137 TL3-S < V3.91
  • Siemens KACO blueplanet 100 NX3 M8 All versions
  • Siemens KACO blueplanet 105 TL3 All versions
  • Siemens KACO blueplanet 110 TL3 All versions
  • Siemens KACO blueplanet 125 NX3 M10 All versions
  • Siemens KACO blueplanet 125 TL3 All versions
  • Siemens KACO blueplanet 137 TL3 All versions
  • Siemens KACO blueplanet 150 TL3 All versions
  • Siemens KACO blueplanet 155 TL3 All versions
  • Siemens KACO blueplanet 165 TL3 All versions
  • Siemens KACO blueplanet 3.0 TL3-60.0 TL3 All versions
  • Siemens KACO blueplanet 87.0 TL3 All versions
  • Siemens KACO blueplanet 92.0 TL3 All versions

Timeline

  • 2026-05-12: advisory: Initial publication by Siemens
  • 2026-05-29: other: Advisory updated to V1.1

References

Related threats