Serial Numbers Become Login Keys in KACO Inverters
A device label should not be enough to open a service account, but that is the weak point here. In KACO blueplanet inverters, the service credentials can be derived from the serial number, so anyone who can observe the label may be able to log in without touching the network perimeter.
CISA says multiple blueplanet models are affected, including 100 NX3 M8, 100 TL3 GEN2, 105 TL3, 105 TL3 GEN2, 110 TL3, 125 NX3 M11, 125 TL3, 125 TL3 GEN2, 137 TL3, 150 TL3, 150 TL3 GEN2, 155 TL3, 155 TL3 GEN2, 165 TL3, 165 TL3 GEN2, 87.0 TL3, 87.0 TL3 GEN2, 92.0 TL3, 92.0 TL3 GEN2, and others. KACO has released new versions for several products and says some GEN2 models are fixed below 6.1.4.9; it is still preparing further fixes and countermeasures for the rest.
Any industrial system that turns an asset ID into a password has the same failure mode. The inventory label becomes a usable secret.