CVE-2026-13337

CVE-2026-13337 is an SQL injection flaw (CWE-564) in the Hibernate layer of Schneider Electric NetBotz appliances, allowing a malicious HQL query to be injected into the NetBotz database. Triggering it requires an attacker to already hold valid login credentials and reach the appliance over the network (adjacent network vector, low privileges, no user interaction), submitting the crafted query via the web-service interface or the web UI. A successful injection yields low-level confidentiality and integrity impact — reading or altering data in the NetBotz monitoring database — rather than full system compromise. Only users of the Schneider Electric NetBotz 5 750 and 755 monitoring appliances are affected. There is no evidence of exploitation: no public proof-of-concept, not listed in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.2%.

What to do: Upgrade NetBotz 5 750/755 appliances to the fixed firmware identified in Schneider Electric's security advisory (SEVD) for CVE-2026-13337. Until patched, restrict access to the web UI and web-service interface to trusted management networks only, since exploitation requires authenticated access. Review and rotate appliance user accounts and monitor NetBotz database activity for unexpected HQL queries or data changes.