CISA and Schneider Electric Issue Advisories for Modicon M340, NetBotz 5 750/755, and PowerChute Serial Shutdown

CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.

CVE-2026-13336 is an OS command injection flaw (CWE-78) in the backup/restore functionality of an affected Schneider Electric product, assigned by Schneider Electric's CNA. It is triggered when an administrator restores a system backup file that has been maliciously modified, causing arbitrary Linux operating system commands to be executed on the device during the restore. Because the CVSS 4.0 vector requires high privileges (PR:H), an adjacent network position (AV:A), and specialized attack conditions (AT:P), exploitation most plausibly requires an attacker who can tamper with a backup file or its storage location, such as an insider or an attacker with access to the network path or backup repository. Successful exploitation yields high impact to confidentiality, integrity, and availability on the vulnerable system (VC:H/VI:H/VA:H), effectively full command execution on the underlying Linux OS. As of this analysis there is no known exploitation, no public proof-of-concept, it is not in the CISA KEV catalog, and EPSS estimates only a 0.6% chance of exploitation in the next 30 days.

Do: Monitor Schneider Electric's security notifications (SEVD) referenced by this CVE and apply the patched firmware or software version once identified in the vendor advisory. Until patched, only restore backups from trusted sources, verify the integrity of backup files (e.g., checksums) before restoring, and restrict access to backup storage and administrative/restore interfaces on the affected device. Given the AV:A attack vector, segment administrative access to the device from untrusted adjacent networks.

CVE-2026-13337 is an SQL injection flaw (CWE-564) in the Hibernate layer of Schneider Electric NetBotz appliances, allowing a malicious HQL query to be injected into the NetBotz database. Triggering it requires an attacker to already hold valid login credentials and reach the appliance over the network (adjacent network vector, low privileges, no user interaction), submitting the crafted query via the web-service interface or the web UI. A successful injection yields low-level confidentiality and integrity impact — reading or altering data in the NetBotz monitoring database — rather than full system compromise. Only users of the Schneider Electric NetBotz 5 750 and 755 monitoring appliances are affected. There is no evidence of exploitation: no public proof-of-concept, not listed in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.2%.

Do: Upgrade NetBotz 5 750/755 appliances to the fixed firmware identified in Schneider Electric's security advisory (SEVD) for CVE-2026-13337. Until patched, restrict access to the web UI and web-service interface to trusted management networks only, since exploitation requires authenticated access. Review and rotate appliance user accounts and monitor NetBotz database activity for unexpected HQL queries or data changes.

Schneider Electric PowerChute Serial Shutdown, the management agent used with APC UPS devices, contains an improper restriction of excessive authentication attempts (CWE-307) that allows an unauthenticated attacker to make an arbitrary number of login attempts against a user account. The weakness manifests when redirect handling is disabled, in which case the software fails to enforce account lockout or rate limiting, enabling an online password brute-force attack. An attacker who succeeds gains unauthorized access to a PowerChute account; the CVSS 4.0 vector indicates low confidentiality impact with no direct integrity or availability impact, so the primary risk is unauthorized visibility into and use of a valid account. Any organization running the affected software is potentially affected, though installations whose web interface is reachable only from trusted internal networks face materially lower risk. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.3% probability of exploitation within 30 days.

Do: Update PowerChute Serial Shutdown to the fixed release identified in Schneider Electric's security notification as soon as it is available. Until then, restrict access to the PowerChute web interface to trusted management networks using firewall rules, verify whether redirect handling has been disabled in your configuration (the condition under which the lockout bypass occurs), use strong unique credentials for PowerChute accounts, and monitor authentication logs for repeated failed login attempts.