Is CVE-2026-41125 actively exploited?

No active exploitation of CVE-2026-41125 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41125 be exploited remotely?

Partially. CVE-2026-41125 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-41125?

CVE-2026-41125 has a CVSS score of 6.0 (MEDIUM).

HOME VULNERABILITIESCVE-2026-41125

MEDIUM

CVE-2026-41125

CWE-89Published: May 12, 2026· Updated: May 12, 2026

6.0

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:3.6th

Official Description

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M11 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions), blueplanet gridsafe 110 TL3-S (All versions), blueplanet gridsafe 137 TL3-S (All versions), blueplanet gridsafe 92.0 TL3-S (All versions), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). Improper neutralization of special elements used in an sql command ('sql injection') in KACO Meteor server allows an authorized attacker to elevate privileges over a local network.

NVD Source

Technical Analysis

CVE-2026-41125 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 6.0.

From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityHigh

Privileges Req.High

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityLow

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-41125

Siemens KACO Blueplanet Inverters

CISA Alerts· Jun 9, 2026

View CSAF Summary KACO blueplanet Inverters contain multiple vulnerabilities that could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access. KACO new energy GmbH has released new versions for several affected products and recommends to update to the latest versions. KACO new energy GmbH is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens KACO Blueplanet Inverters are affected: blueplanet 100 NX3 M8 vers:all/* blueplanet 100 TL3 GEN2 vers:all/*, vers:intdot/<6.1.4.9 blueplanet 105 TL3 vers:all/* blueplanet 105 TL3 GEN2 vers:all/*, vers:intdot/<6.1.4.9 blueplanet 110 TL3 vers:all/* blu [xlite_meta score:73 src:CISA Alerts xlite_fp:14dfd9ae9970e354ed01eb735ea8f0bc0b1d70af38ec72ae31271ce370d78d88]