Kieback&Peter Neutrino-GLT command injection vulnerability patched
Kieback&Peter Neutrino-GLT building management system contains a command injection vulnerability in the SM70 PHWEB web component login form (CVE-2025-6225), fixed in version 9.40.02.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of a shell command injection vulnerability in Kieback&Peter's Neutrino-GLT building management product. The vulnerability, tracked as CVE-2025-6225, affects the SM70 PHWEB web component and allows attackers to inject shell commands through the login form. Successfully exploited commands execute with low system privileges.
The vulnerability was responsibly disclosed by security researcher Jan Barszcz. Kieback&Peter has released version 9.40.02 to address the issue. Organizations using affected versions of Neutrino-GLT should prioritize patching to mitigate the risk of unauthorized command execution on building management systems.
While the vulnerability executes with limited privileges, command injection flaws in building management systems pose operational and safety risks, as these systems often control critical infrastructure including HVAC, lighting, and physical security systems.
Mentioned in this report
Detection guidance
Web Application Process Spawning Shell Interpreter (Possible Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web/application server process (as would host the Neutrino-GLT SM70 PHWEB component) spawning a shell interpreter with command chaining metacharacters, consistent with exploitation of a command injection vulnerability like CVE-2025-6225. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Application Process Spawning Shell With Command Chaining
id: 82713ff3-baf4-5286-90b1-f96e72f5d2a2
status: experimental
description: 'Detects a shell interpreter (sh, bash, dash) spawned by a web/application
server
process with a command line containing shell metacharacters used for command
chaining or substitution. This behaviour is typical of exploitation of a
command injection vulnerability in a web-facing component, such as CVE-2025-6225
affecting Kieback&Peter Neutrino-GLT SM70 PHWEB, where attacker input reaches a
shell invocation via a login form field.
'
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /tomcat
- /java
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
selection_chain:
CommandLine|contains:
- ;
- '&&'
- '||'
- $(
- '`'
- '|'
filter:
CommandLine|contains:
- /usr/sbin/logrotate
- health-check
condition: selection_parent and selection_shell and selection_chain and not filter
falsepositives:
- Legitimate application-triggered shell scripts (log rotation, health checks, monitoring
hooks) invoked with pipes or semicolons
- Custom web application deployment scripts that legitimately shell out with chained
commands
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant
Shell Command Execution With Reconnaissance/Enumeration Commands From Web Server Context
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell spawned by a web-facing service process executing common post-exploitation enumeration commands (id, whoami, uname, wget, curl), indicating successful command injection against a public-facing application such as Neutrino-GLT SM70 PHWEB. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Enumeration Commands Executed By Shell Spawned From Web Server Process
id: a344b96a-7873-5fa9-ae13-3426e1a7939f
status: experimental
description: 'Detects execution of common reconnaissance or download utilities (id,
whoami,
uname, wget, curl) run via a shell process whose parent is a web/application
server. This pattern is consistent with an attacker leveraging a command
injection vulnerability in a public-facing web component (e.g. CVE-2025-6225
in Kieback&Peter Neutrino-GLT SM70 PHWEB) to execute arbitrary commands with
the privileges of the web service.
'
logsource:
category: process_creation
product: linux
detection:
selection_parent_shell:
ParentImage|endswith:
- /sh
- /bash
- /dash
selection_grandparent_web:
ParentCommandLine|contains:
- httpd
- apache2
- nginx
- php-fpm
- tomcat
selection_commands:
Image|endswith:
- /id
- /whoami
- /uname
- /wget
- /curl
condition: selection_parent_shell and selection_grandparent_web and selection_commands
falsepositives:
- Legitimate monitoring or diagnostic scripts running under the web server account
that call id/uname/curl
- Automated deployment tooling that queries system info via the application service
account
level: medium
tags:
- attack.t1059
- attack.t1190
author: Vorant
Public-Facing Login Form Triggering OS Command Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an HTTP request to a login/authentication endpoint immediately followed by process execution on the host, indicating possible exploitation of a login-form command injection vulnerability such as CVE-2025-6225 in Neutrino-GLT SM70 PHWEB. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution Immediately Following Login Endpoint Request
id: 78625722-4ecf-5c67-84af-ea0d2516b543
status: experimental
description: 'Detects a shell or command interpreter process created by a web application
process shortly after a request to a login-related URI path. This combined
behaviour is indicative of exploitation of an authentication-form command
injection vulnerability, as described for CVE-2025-6225 affecting the
Kieback&Peter Neutrino-GLT SM70 PHWEB login form. Correlate with web access
logs showing POST requests to /login or similar endpoints occurring within
a short time window (e.g. a few seconds) before the process creation event.
'
logsource:
category: process_creation
product: linux
detection:
selection_parent_web:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /tomcat
selection_shell:
Image|endswith:
- /sh
- /bash
selection_susp_arg:
CommandLine|contains:
- -c
condition: selection_parent_web and selection_shell and selection_susp_arg
falsepositives:
- Web applications that legitimately shell out to run helper scripts as part of normal
login processing (e.g. PAM helpers)
- Health-check or session-cleanup scripts triggered by the application server
level: medium
tags:
- attack.t1190
- attack.t1059
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-6225
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs