This vulnerability (CVE-2026-41125) involves improper neutralization of special elements used in SQL commands (CWE-89) in Siemens blueplanet product lines, specifically within the KACO Meteor server. It affects all versions of numerous blueplanet models. An authorized attacker with local network access can exploit this SQL injection flaw to elevate privileges. The CVSS 3.1 base score is 6.0, reflecting medium severity with attack vector as adjacent network, high attack complexity, and requiring high privileges but no user interaction. Confidentiality impact is low, while integrity and availability impacts are high. No patch or official remediation guidance is currently available from Siemens.

The vulnerability allows an authorized attacker on the local network to perform SQL injection attacks against the KACO Meteor server component in affected Siemens blueplanet products. This can lead to privilege escalation, potentially compromising system integrity and availability. Confidentiality impact is limited. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Siemens communications for updates. Until a patch is available, limit local network access to authorized personnel and consider additional network segmentation to reduce exposure.