# Kieback&Peter Neutrino-GLT building management system contains a command injection…

Published: 2026-01-07 · Severity: high · Sectors: infrastructure
Canonical: https://vorant.io/reports/6bf68fa8-bd37-4acd-90ad-3fffadd756ee/kieback-peter-neutrino-glt-building-management-system-contains-a-command

> Kieback&Peter Neutrino-GLT building management system contains a command injection vulnerability in the SM70 PHWEB web component login form (CVE-2025-6225), fixed in version 9.40.02.

CERT Polska coordinated the disclosure of a shell command injection vulnerability in Kieback&Peter's Neutrino-GLT building management product. The vulnerability, tracked as CVE-2025-6225, affects the SM70 PHWEB web component and allows attackers to inject shell commands through the login form. Successfully exploited commands execute with low system privileges.

The vulnerability was responsibly disclosed by security researcher Jan Barszcz. Kieback&Peter has released version 9.40.02 to address the issue. Organizations using affected versions of Neutrino-GLT should prioritize patching to mitigate the risk of unauthorized command execution on building management systems.

While the vulnerability executes with limited privileges, command injection flaws in building management systems pose operational and safety risks, as these systems often control critical infrastructure including HVAC, lighting, and physical security systems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-6225

## Detection guidance (public sample)

### Web Application Process Spawning Shell Interpreter (Possible Command Injection)

ATT&CK: T1059

Detects a web/application server process (as would host the Neutrino-GLT SM70 PHWEB component) spawning a shell interpreter with command chaining metacharacters, consistent with exploitation of a command injection vulnerability like CVE-2025-6225. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Application Process Spawning Shell With Command Chaining
id: 82713ff3-baf4-5286-90b1-f96e72f5d2a2
status: experimental
description: 'Detects a shell interpreter (sh, bash, dash) spawned by a web/application
  server

  process with a command line containing shell metacharacters used for command

  chaining or substitution. This behaviour is typical of exploitation of a

  command injection vulnerability in a web-facing component, such as CVE-2025-6225

  affecting Kieback&Peter Neutrino-GLT SM70 PHWEB, where attacker input reaches a

  shell invocation via a login form field.

  '
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /tomcat
    - /java
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  selection_chain:
    CommandLine|contains:
    - ;
    - '&&'
    - '||'
    - $(
    - '`'
    - '|'
  filter:
    CommandLine|contains:
    - /usr/sbin/logrotate
    - health-check
  condition: selection_parent and selection_shell and selection_chain and not filter
falsepositives:
- Legitimate application-triggered shell scripts (log rotation, health checks, monitoring
  hooks) invoked with pipes or semicolons
- Custom web application deployment scripts that legitimately shell out with chained
  commands
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant
```

### Shell Command Execution With Reconnaissance/Enumeration Commands From Web Server Context

ATT&CK: T1059

Detects a shell spawned by a web-facing service process executing common post-exploitation enumeration commands (id, whoami, uname, wget, curl), indicating successful command injection against a public-facing application such as Neutrino-GLT SM70 PHWEB. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Enumeration Commands Executed By Shell Spawned From Web Server Process
id: a344b96a-7873-5fa9-ae13-3426e1a7939f
status: experimental
description: 'Detects execution of common reconnaissance or download utilities (id,
  whoami,

  uname, wget, curl) run via a shell process whose parent is a web/application

  server. This pattern is consistent with an attacker leveraging a command

  injection vulnerability in a public-facing web component (e.g. CVE-2025-6225

  in Kieback&Peter Neutrino-GLT SM70 PHWEB) to execute arbitrary commands with

  the privileges of the web service.

  '
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent_shell:
    ParentImage|endswith:
    - /sh
    - /bash
    - /dash
  selection_grandparent_web:
    ParentCommandLine|contains:
    - httpd
    - apache2
    - nginx
    - php-fpm
    - tomcat
  selection_commands:
    Image|endswith:
    - /id
    - /whoami
    - /uname
    - /wget
    - /curl
  condition: selection_parent_shell and selection_grandparent_web and selection_commands
falsepositives:
- Legitimate monitoring or diagnostic scripts running under the web server account
  that call id/uname/curl
- Automated deployment tooling that queries system info via the application service
  account
level: medium
tags:
- attack.t1059
- attack.t1190
author: Vorant
```

### Public-Facing Login Form Triggering OS Command Execution

ATT&CK: T1190

Detects an HTTP request to a login/authentication endpoint immediately followed by process execution on the host, indicating possible exploitation of a login-form command injection vulnerability such as CVE-2025-6225 in Neutrino-GLT SM70 PHWEB. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Execution Immediately Following Login Endpoint Request
id: 78625722-4ecf-5c67-84af-ea0d2516b543
status: experimental
description: 'Detects a shell or command interpreter process created by a web application

  process shortly after a request to a login-related URI path. This combined

  behaviour is indicative of exploitation of an authentication-form command

  injection vulnerability, as described for CVE-2025-6225 affecting the

  Kieback&Peter Neutrino-GLT SM70 PHWEB login form. Correlate with web access

  logs showing POST requests to /login or similar endpoints occurring within

  a short time window (e.g. a few seconds) before the process creation event.

  '
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent_web:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /tomcat
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
  selection_susp_arg:
    CommandLine|contains:
    - -c
  condition: selection_parent_web and selection_shell and selection_susp_arg
falsepositives:
- Web applications that legitimately shell out to run helper scripts as part of normal
  login processing (e.g. PAM helpers)
- Health-check or session-cleanup scripts triggered by the application server
level: medium
tags:
- attack.t1190
- attack.t1059
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-6225

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6bf68fa8-bd37-4acd-90ad-3fffadd756ee/kieback-peter-neutrino-glt-building-management-system-contains-a-command.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup