CVE-2025-40946: CWE-321: Use of Hard-coded Cryptographic Key in Siemens blueplanet 100 NX3 M8
A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M10 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0 TL3-60.0 TL3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions < V6.1.4.9), blueplanet gridsave 110 TL3-S (All versions < V3.91), blueplanet gridsave 137 TL3-S (All versions < V3.91), blueplanet gridsave 92.0 TL3-S (All versions < V3.91), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). A CRC16-based algorithm for generating Technical Service credentials could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access.
AI Analysis
Technical Summary
This vulnerability (CVE-2025-40946) affects a wide range of Siemens blueplanet devices across many versions. The core issue is the use of a hard-coded cryptographic key mechanism (CWE-321) where a CRC16-based algorithm generates Technical Service credentials based on the device serial number. This weak cryptographic approach allows an attacker to derive these credentials, potentially leading to unauthorized access to the device. The CVSS 3.1 score is 8.3, reflecting high impact with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality (low), integrity (high), and availability (high). The vendor has not provided an official fix or remediation guidance yet, and no exploits are known in the wild.
Potential Impact
An attacker who successfully derives the Technical Service credentials can gain unauthorized access to affected Siemens blueplanet devices. This can compromise device integrity and availability, and partially impact confidentiality. The vulnerability affects a broad set of device models and versions, increasing the potential attack surface. However, no known exploits have been reported in the wild so far.
Mitigation Recommendations
Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected devices to trusted networks and monitor for unusual access attempts. Avoid exposing these devices to untrusted networks. Follow Siemens advisories closely for updates on patches or mitigations.
CVE-2025-40946: CWE-321: Use of Hard-coded Cryptographic Key in Siemens blueplanet 100 NX3 M8
Description
A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M10 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0 TL3-60.0 TL3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions < V6.1.4.9), blueplanet gridsave 110 TL3-S (All versions < V3.91), blueplanet gridsave 137 TL3-S (All versions < V3.91), blueplanet gridsave 92.0 TL3-S (All versions < V3.91), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). A CRC16-based algorithm for generating Technical Service credentials could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access.
CVSS v3.1
Score 8.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2025-40946) affects a wide range of Siemens blueplanet devices across many versions. The core issue is the use of a hard-coded cryptographic key mechanism (CWE-321) where a CRC16-based algorithm generates Technical Service credentials based on the device serial number. This weak cryptographic approach allows an attacker to derive these credentials, potentially leading to unauthorized access to the device. The CVSS 3.1 score is 8.3, reflecting high impact with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality (low), integrity (high), and availability (high). The vendor has not provided an official fix or remediation guidance yet, and no exploits are known in the wild.
Potential Impact
An attacker who successfully derives the Technical Service credentials can gain unauthorized access to affected Siemens blueplanet devices. This can compromise device integrity and availability, and partially impact confidentiality. The vulnerability affects a broad set of device models and versions, increasing the potential attack surface. However, no known exploits have been reported in the wild so far.
Mitigation Recommendations
Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected devices to trusted networks and monitor for unusual access attempts. Avoid exposing these devices to untrusted networks. Follow Siemens advisories closely for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- siemens
- Date Reserved
- 2025-04-16T09:06:15.879Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a02f117cbff5d8610c13a4d
Added to database: 05/12/2026, 09:21:27 UTC
Last enriched: 05/29/2026, 20:02:26 UTC
Last updated: 07/31/2026, 19:22:55 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.