KACO Inverters exposed via hardcoded credential flaw
Multiple KACO blueplanet inverters contain a weak credential generation algorithm allowing attackers to derive technical service credentials from device serial numbers.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory detailing two vulnerabilities in Siemens KACO blueplanet inverters widely deployed in energy infrastructure. CVE-2025-40946 describes a CRC16-based algorithm used to generate technical service credentials that can be derived from the device's serial number, enabling unauthorized access. CVE-2026-41125 is a SQL injection vulnerability in the KACO Meteor server that allows authenticated attackers to escalate privileges over local networks.
The vulnerabilities affect over 30 inverter models across the blueplanet product line. KACO has released firmware version 6.1.4.9 for several GEN2 models and version 3.91 for gridsafe variants, but many affected products have no fix available or planned. The vendor recommends operators implement network segmentation, firewall protections, and VPN access controls as compensating measures.
Given the critical infrastructure context and the ease of exploiting predictable credentials, this advisory warrants immediate attention from energy sector organizations using KACO equipment. Operators should validate their grid protection schemes include appropriate redundancy and isolation to mitigate potential impacts from compromised inverters.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-160-02
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs