A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M11 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions), blueplanet gridsafe 110 TL3-S (All versions), blueplanet gridsafe 137 TL3-S (All versions), blueplanet gridsafe 92.0 TL3-S (All versions), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). Improper neutralization of special elements used in an sql command ('sql injection') in KACO Meteor server allows an authorized attacker to elevate privileges over a local network.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Siemens | blueplanet 100 NX3 M8 | unknown |
|
||||||
| Siemens | blueplanet 100 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 105 TL3 | unknown |
|
||||||
| Siemens | blueplanet 105 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 110 TL3 | unknown |
|
||||||
| Siemens | blueplanet 125 NX3 M11 | unknown |
|
||||||
| Siemens | blueplanet 125 TL3 | unknown |
|
||||||
| Siemens | blueplanet 125 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 137 TL3 | unknown |
|
||||||
| Siemens | blueplanet 150 TL3 | unknown |
|
||||||
| Siemens | blueplanet 150 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 155 TL3 | unknown |
|
||||||
| Siemens | blueplanet 155 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 165 TL3 | unknown |
|
||||||
| Siemens | blueplanet 165 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 25.0 NX3-33.0 NX3 | unknown |
|
||||||
| Siemens | blueplanet 3.0 NX3-20.0 NX3 | unknown |
|
||||||
| Siemens | blueplanet 3.0-5.0 NX1 | unknown |
|
||||||
| Siemens | blueplanet 360 NX3 M6 | unknown |
|
||||||
| Siemens | blueplanet 50.0 NX3-60.0 NX3 | unknown |
|
||||||
| Siemens | blueplanet 87.0 TL3 | unknown |
|
||||||
| Siemens | blueplanet 87.0 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet 92.0 TL3 | unknown |
|
||||||
| Siemens | blueplanet 92.0 TL3 GEN2 | unknown |
|
||||||
| Siemens | blueplanet gridsafe 110 TL3-S | unknown |
|
||||||
| Siemens | blueplanet gridsafe 137 TL3-S | unknown |
|
||||||
| Siemens | blueplanet gridsafe 92.0 TL3-S | unknown |
|
||||||
| Siemens | blueplanet hybrid 10.0 TL3 | unknown |
|
||||||
| Siemens | blueplanet hybrid 6.0 NH3-12.0 NH3 | unknown |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 12 May 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 12 May 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | KACO Meteor SQL Injection Enables Local Privilege Escalation |
Tue, 12 May 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M11 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions), blueplanet gridsafe 110 TL3-S (All versions), blueplanet gridsafe 137 TL3-S (All versions), blueplanet gridsafe 92.0 TL3-S (All versions), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). Improper neutralization of special elements used in an sql command ('sql injection') in KACO Meteor server allows an authorized attacker to elevate privileges over a local network. | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: siemens
Published:
Updated: 2026-05-12T12:42:01.940Z
Reserved: 2026-04-17T11:25:13.214Z
Link: CVE-2026-41125
Vulnrichment
Updated: 2026-05-12T12:41:56.398Z
NVD
Status : Awaiting Analysis
Published: 2026-05-12T10:16:46.057
Modified: 2026-05-12T14:19:41.400
Link: CVE-2026-41125
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-12T10:30:13Z
Weaknesses