Schneider Electric Saitel RTUs vulnerable to OS command injection
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
OS command injection in Saitel DR and DP RTUs allows authenticated attackers to execute arbitrary shell commands; patches available.
Schneider Electric Saitel DR Remote Terminal Unit (versions 11.06.29 and prior) and Saitel DP RTU (versions 11.06.33 and prior) contain two OS command injection vulnerabilities in the BLMon Console utility. Both CVE-2025-9996 and CVE-2025-9997 are CWE-78 flaws that allow an authenticated local attacker with SSH access to inject and execute arbitrary shell commands on the affected devices by manipulating input to the netstat command. Attack complexity is low and requires only low privileges; there is no user interaction required. The vulnerabilities carry a CVSS v4.0 base score of 5.8 and are not remotely exploitable.
Schneider Electric has released fixed firmware versions: HUe Firmware 11.06.30 for Saitel DR and firmware SM_CPU866e 11.06.34 for Saitel DP. These devices are deployed across commercial facilities, critical manufacturing, and energy sectors worldwide. CISA reports no known public exploitation in the wild at this time. Organizations unable to patch immediately should restrict SSH access via firewalls, limit BLMon permissions to minimal required roles, and ensure least-privilege user assignments. Standard ICS defense practices—network isolation, physical security, and air-gapped programming—remain critical controls.
Mentioned in this report
Detection guidance
Shell Spawned by netstat Process
netstat spawning a shell or interpreter child is abnormal and matches OS command injection through netstat input, as in the Saitel BLMon Console flaws (CVE-2025-9996/9997). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned by netstat Process
description: Detects a Linux shell or interpreter launched with netstat as the parent
process. netstat does not normally spawn children, so this indicates command injection
via netstat arguments, as in the Saitel BLMon Console flaws (CWE-78).
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /netstat
Image|endswith:
- /sh
- /bash
- /dash
- /ash
- /busybox
- /python
- /python3
- /perl
condition: selection
falsepositives:
- Custom monitoring wrappers that replace or hook the netstat binary and launch a
helper shell
level: high
id: 9603332f-bb5d-5b6a-84e1-f6f0af3011e4
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-03
BLMon Console Spawning Shell With Injection Metacharacters
A BLMon process spawning a shell whose command line carries command-chaining or substitution metacharacters suggests injection through the BLMon netstat function on Saitel RTUs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: BLMon Console Spawning Shell With Injection Metacharacters
description: Detects a BLMon console process spawning a Linux shell whose command
line contains command-chaining or substitution metacharacters. This pattern fits
OS command injection through input to the netstat function in the Saitel BLMon Console
(CVE-2025-9996/9997). The BLMon process name is inferred from the advisory, so tune
it to the local install.
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains: blmon
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
selection_meta:
CommandLine|contains:
- ;
- '&&'
- '||'
- '`'
- $(
condition: selection_parent and selection_child and selection_meta
falsepositives:
- Legitimate BLMon maintenance functions that chain several shell commands in one
invocation
level: medium
id: 8815d2e4-1474-592b-b29c-2fc02378447d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs