CISA and Schneider Electric Issue Advisories for Modicon M340, NetBotz 5 750/755, and PowerChute Serial Shutdown

CISA and Schneider Electric published advisories covering four vulnerabilities — CVE-2025-6625, CVE-2026-13336, CVE-2026-13337, and CVE-2026-13348 — across Modicon M340 controllers/communication modules, NetBotz 5 750/755 environmental monitors, and…

Per CISA advisory reports dated 2026-09-17, CISA and Schneider Electric released advisories for four flaws across three Schneider Electric product lines. Advisory SEVD-2025-224-05 (republished by CISA) describes CVE-2025-6625 (CWE-20 improper input validation, CVSS v3.1 base score 7.5) in Modicon M340 controllers and X80 Ethernet, M580 Global Data, and Modbus/TCP communication modules: a crafted FTP command sent to an affected device causes denial of service. Affected M340 firmware is prior to SV3.70, and fixes are available including M340 firmware SV3.70. Advisory ICSA-26-260-05 covers NetBotz 5 750/755 environmental monitors running versions 5.5.2 and prior: CVE-2026-13336 (CWE-78 OS command injection, CVSS 6.4) allows Linux command execution when a maliciously modified system backup is restored, and CVE-2026-13337 (CWE-564 Hibernate SQL injection, CVSS 4.6) allows HQL injection into the NetBotz database via the web service or web UI; successful exploitation could enable code execution, device manipulation, and unauthorized data access on the local network. Advisory ICSA-26-260-07 covers CVE-2026-13348 (CWE-307 improper restriction of excessive authentication attempts, CVSS 3.1 score 5.3) in PowerChute Serial Shutdown versions 1.5 and prior, which lets attackers perform an arbitrary number of authentication attempts when redirect handling is disabled, gaining unauthorized access to user accounts; the UPS management software is deployed across commercial facilities, critical manufacturing, energy, and IT sectors worldwide, and CISA recommends network isolation, VPN-protected remote access, and applying the vendor fix. Fixes are available for all four flaws. The NetBotz and PowerChute advisories report no indication of exploitation in the wild; the Modicon M340 advisory does not state an exploitation status.