Schneider Electric NetBotz 5 flaws enable command execution
Two vulnerabilities in Schneider Electric NetBotz 5 750/755 (≤5.5.2) allow OS command injection via malicious backup restore and HQL injection via web UI/API, fixed in 5.6.0.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Schneider Electric, via CISA ICS advisory ICSA-26-260-05, disclosed two vulnerabilities affecting NetBotz 5 750 and 755 environmental and security monitoring appliances, versions 5.5.2 and earlier. CVE-2026-13336 is an OS command injection flaw (CWE-78) that can execute arbitrary Linux OS commands when a maliciously modified system backup is restored. CVE-2026-13337 is a SQL/HQL injection vulnerability (CWE-564) in the Hibernate-backed NetBotz database, exploitable by an authenticated user via the web-service interface or web UI, allowing injection of malicious HQL queries.
Successful exploitation could result in arbitrary or remote code execution over the local network, device manipulation, and unauthorized data access — a significant risk given NetBotz devices are deployed for environmental and physical security monitoring across commercial facilities, critical manufacturing, and IT sectors worldwide. There is no indication of active in-the-wild exploitation; this is a vendor-disclosed advisory reported by Schneider Electric CPCERT.
Schneider Electric has released version 5.6.0 for both NetBotz 5 750 and 755, which remediates both vulnerabilities and requires a reboot upon installation. Defenders should verify version via the 'About NetBotz' GUI option post-update. Standard ICS hardening is recommended: isolate control/monitoring networks behind firewalls, avoid direct internet exposure, restrict backup restore operations to trusted/verified sources, and use VPNs with proper patching for remote access.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-05
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs