Schneider Electric NetBotz 5 750/755
CISA and Schneider Electric issued an advisory for NetBotz 5 750/755 covering OS command injection and Hibernate SQL injection flaws in versions 5.5.2 and prior.
CISA published ICSA-26-260-05 for two flaws in Schneider Electric NetBotz 5 750/755 environmental monitors running versions 5.5.2 and prior. CVE-2026-13336 (CWE-78, CVSS 6.4) allows Linux command execution when a maliciously modified backup is restored, and CVE-2026-13337 (CWE-564, CVSS 4.6) allows HQL injection into the NetBotz database via the web interface. Successful exploitation could enable code execution, device manipulation, and unauthorized data access on the local network.
- CVE-2026-13336: OS command injection via maliciously modified system backup restore
- CVE-2026-13337: Hibernate SQL injection through the web service or web UI
- Affects NetBotz 5 750/755 versions 5.5.2 and prior; fixes available
- No indication of exploitation in the wild
- Vendors
- Schneider Electric
- Products
- NetBotz 5 750/755
- Organizations
- CISA
- Countries
- France
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13336 | OS Command Injection via Malicious Backup Restore in Schneider Electric Product | 7.3 | <1% | ||
| CVE-2026-13337 | Authenticated HQL Injection in Schneider Electric NetBotz 5 750/755 | 5.1 | <1% |
From the original article
6 min read at cisa.govView CSAF Summary Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products. The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.