Junglewise Threat Intelligence

CVE-2026-41125: Siemens KACO blueplanet SQL injection in Meteor server

CVE-2026-41125 · Severity: medium · CVSS 6 · Published 2026-05-12

Executive brief

A security vulnerability has been found in several KACO blueplanet solar inverters, which are devices used to manage power in solar energy systems. An attacker with existing access to the local network could exploit this flaw to gain higher-level administrative control over the device. This could allow unauthorized changes to power management settings, potentially impacting energy operations or local grid stability.

Technical details

An SQL injection vulnerability (CWE-89) exists in the KACO Meteor server component of various blueplanet inverter models. The flaw is caused by improper neutralization of special elements used in SQL commands. An authorized attacker with access to the local network can exploit this vulnerability to execute arbitrary SQL commands, leading to privilege escalation. While the attack requires high privileges and specific conditions (AC:H), it can result in a high impact on integrity and availability. As of the advisory date, no fixes are available for the affected models, and Siemens recommends following general security hardening guidelines for critical power systems.

Affected products

  • KACO new energy (Siemens) blueplanet 100 NX3 M8 All versions
  • KACO new energy (Siemens) blueplanet 100 TL3 GEN2 All versions
  • KACO new energy (Siemens) blueplanet 105 TL3 All versions
  • KACO new energy (Siemens) blueplanet 105 TL3 GEN2 All versions
  • KACO new energy (Siemens) blueplanet 110 TL3 All versions
  • KACO new energy (Siemens) blueplanet 125 NX3 M10 All versions
  • KACO new energy (Siemens) blueplanet 125 TL3 All versions
  • KACO new energy (Siemens) blueplanet 125 TL3 GEN2 All versions
  • KACO new energy (Siemens) blueplanet 137 TL3 All versions
  • KACO new energy (Siemens) blueplanet 150 TL3 All versions
  • KACO new energy (Siemens) blueplanet 150 TL3 GEN2 All versions
  • KACO new energy (Siemens) blueplanet 155 TL3 All versions
  • KACO new energy (Siemens) blueplanet 155 TL3 GEN2 All versions
  • KACO new energy (Siemens) blueplanet 165 TL3 All versions
  • KACO new energy (Siemens) blueplanet 165 TL3 GEN2 All versions
  • KACO new energy (Siemens) blueplanet gridsave 92.0 TL3-S All versions
  • KACO new energy (Siemens) blueplanet gridsave 110 TL3-S All versions
  • KACO new energy (Siemens) blueplanet gridsave 137 TL3-S All versions

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory
  • 2026-05-29: other: Advisory updated to V1.1

References

Related threats