CVE-2025-40946: blueplanet 100 NX3 M8 0 to before *; +22 more affected products

Affected technology

blueplanet 100 NX3 M8 · 0 to before *
Siemens

blueplanet 100 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 105 TL3 · 0 to before V3.92
Siemens

blueplanet 105 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 110 TL3 · 0 to before V3.92
Siemens

blueplanet 125 NX3 M10 · 0 to before *
Siemens

blueplanet 125 TL3 · 0 to before V3.92
Siemens

blueplanet 125 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 137 TL3 · 0 to before V3.92
Siemens

blueplanet 150 TL3 · 0 to before V3.92
Siemens

blueplanet 150 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 155 TL3 · 0 to before V3.92
Siemens

blueplanet 155 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 165 TL3 · 0 to before V3.92
Siemens

blueplanet 165 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 3.0 TL3-60.0 TL3 · 0 to before *
Siemens

blueplanet 87.0 TL3 · 0 to before V3.92
Siemens

blueplanet 87.0 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet 92.0 TL3 · 0 to before V3.92
Siemens

blueplanet 92.0 TL3 GEN2 · 0 to before V6.1.4.9
Siemens

blueplanet gridsave 110 TL3-S · 0 to before V3.91
Siemens

blueplanet gridsave 137 TL3-S · 0 to before V3.91
Siemens

blueplanet gridsave 92.0 TL3-S · 0 to before V3.91
Siemens

Description’s affected range: versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions < V3.92), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An attacker could derive the credentials from the devices serial number and misuse them to gain unauthorized access. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as low; integrity and availability impact as high.