# Schneider Electric Saitel RTUs vulnerable to OS command injection

Published: 2025-09-18 · Severity: routine · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/8065e4a0-17ba-505b-a2d8-311bbe640d16/schneider-electric-saitel-rtus-vulnerable-to-os-command-injection

> OS command injection in Saitel DR and DP RTUs allows authenticated attackers to execute arbitrary shell commands; patches available.

Schneider Electric Saitel DR Remote Terminal Unit (versions 11.06.29 and prior) and Saitel DP RTU (versions 11.06.33 and prior) contain two OS command injection vulnerabilities in the BLMon Console utility. Both CVE-2025-9996 and CVE-2025-9997 are CWE-78 flaws that allow an authenticated local attacker with SSH access to inject and execute arbitrary shell commands on the affected devices by manipulating input to the netstat command. Attack complexity is low and requires only low privileges; there is no user interaction required. The vulnerabilities carry a CVSS v4.0 base score of 5.8 and are not remotely exploitable.

Schneider Electric has released fixed firmware versions: HUe Firmware 11.06.30 for Saitel DR and firmware SM_CPU866e 11.06.34 for Saitel DP. These devices are deployed across commercial facilities, critical manufacturing, and energy sectors worldwide. CISA reports no known public exploitation in the wild at this time. Organizations unable to patch immediately should restrict SSH access via firewalls, limit BLMon permissions to minimal required roles, and ensure least-privilege user assignments. Standard ICS defense practices—network isolation, physical security, and air-gapped programming—remain critical controls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9996, CVE-2025-9997

## Detection guidance (public sample)

### Shell Spawned by netstat Process

ATT&CK: T1059.004

netstat spawning a shell or interpreter child is abnormal and matches OS command injection through netstat input, as in the Saitel BLMon Console flaws (CVE-2025-9996/9997). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Spawned by netstat Process
description: Detects a Linux shell or interpreter launched with netstat as the parent
  process. netstat does not normally spawn children, so this indicates command injection
  via netstat arguments, as in the Saitel BLMon Console flaws (CWE-78).
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /netstat
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
    - /busybox
    - /python
    - /python3
    - /perl
  condition: selection
falsepositives:
- Custom monitoring wrappers that replace or hook the netstat binary and launch a
  helper shell
level: high
id: 9603332f-bb5d-5b6a-84e1-f6f0af3011e4
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-03
```

### BLMon Console Spawning Shell With Injection Metacharacters

ATT&CK: T1059.004

A BLMon process spawning a shell whose command line carries command-chaining or substitution metacharacters suggests injection through the BLMon netstat function on Saitel RTUs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: BLMon Console Spawning Shell With Injection Metacharacters
description: Detects a BLMon console process spawning a Linux shell whose command
  line contains command-chaining or substitution metacharacters. This pattern fits
  OS command injection through input to the netstat function in the Saitel BLMon Console
  (CVE-2025-9996/9997). The BLMon process name is inferred from the advisory, so tune
  it to the local install.
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: blmon
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  selection_meta:
    CommandLine|contains:
    - ;
    - '&&'
    - '||'
    - '`'
    - $(
  condition: selection_parent and selection_child and selection_meta
falsepositives:
- Legitimate BLMon maintenance functions that chain several shell commands in one
  invocation
level: medium
id: 8815d2e4-1474-592b-b29c-2fc02378447d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8065e4a0-17ba-505b-a2d8-311bbe640d16/schneider-electric-saitel-rtus-vulnerable-to-os-command-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup