Riskcovery

CVE-2026-41125

State
Published
Severity
5.9 Medium
Published
May 12, 2026
Updated
Oct 13, 2026
Reserved
Apr 17, 2026

Read the record on cve.org

Description

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions < V3.92), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions < V3.92), blueplanet 125 NX3 M10 (All versions), blueplanet 125 TL3 (All versions < V3.92), blueplanet 125 TL3 GEN2 (All versions), blueplanet 137 TL3 (All versions < V3.92), blueplanet 150 TL3 (All versions < V3.92), blueplanet 150 TL3 GEN2 (All versions), blueplanet 155 TL3 (All versions < V3.92), blueplanet 155 TL3 GEN2 (All versions), blueplanet 165 TL3 (All versions < V3.92), blueplanet 165 TL3 GEN2 (All versions), blueplanet 87.0 TL3 (All versions < V3.92), blueplanet 87.0 TL3 GEN2 (All versions), blueplanet 92.0 TL3 (All versions < V3.92), blueplanet 92.0 TL3 GEN2 (All versions), blueplanet gridsave 110 TL3-S (All versions < V3.92), blueplanet gridsave 137 TL3-S (All versions < V3.92), blueplanet gridsave 92.0 TL3-S (All versions < V3.92). Improper neutralization of special elements used in an sql command ('sql injection') in KACO Meteor server allows an authorized attacker to elevate privileges over a local network.

Scores

CVSSScoreVectorSource
4.05.9 MediumCVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:Nsiemens
3.16.0 MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:Hsiemens

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
blueplanet 100 NX3 M8Siemens
  • all versionsAffected
blueplanet 100 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 105 TL3Siemens
  • before V3.92Affected
blueplanet 105 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 110 TL3Siemens
  • before V3.92Affected
blueplanet 125 NX3 M10Siemens
  • all versionsAffected
blueplanet 125 TL3Siemens
  • before V3.92Affected
blueplanet 125 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 137 TL3Siemens
  • before V3.92Affected
blueplanet 150 TL3Siemens
  • before V3.92Affected
blueplanet 150 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 155 TL3Siemens
  • before V3.92Affected
blueplanet 155 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 165 TL3Siemens
  • before V3.92Affected
blueplanet 165 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 25.0 NX3-33.0 NX3Siemens
  • all versionsNot affected
blueplanet 3.0 NX3-20.0 NX3Siemens
  • all versionsNot affected
blueplanet 3.0-5.0 NX1Siemens
  • all versionsNot affected
blueplanet 360 NX3 M6Siemens
  • all versionsNot affected
blueplanet 50.0 NX3-60.0 NX3Siemens
  • all versionsNot affected
blueplanet 87.0 TL3Siemens
  • before V3.92Affected
blueplanet 87.0 TL3 GEN2Siemens
  • all versionsAffected
blueplanet 92.0 TL3Siemens
  • before V3.92Affected
blueplanet 92.0 TL3 GEN2Siemens
  • all versionsAffected
blueplanet gridsave 110 TL3-SSiemens
  • before V3.92Affected
blueplanet gridsave 137 TL3-SSiemens
  • before V3.92Affected
blueplanet gridsave 92.0 TL3-SSiemens
  • before V3.92Affected
blueplanet hybrid 10.0 TL3Siemens
  • all versionsNot affected
blueplanet hybrid 6.0 NH3-12.0 NH3Siemens
  • all versionsNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.