> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Schneider Electric NetBotz 5 750/755
- URL: https://f4n6.co.uk/security-feed/schneider-electric-netbotz-5-750-755/
- Published: 2026-09-17T21:42:16.000Z
- Updated: 2026-09-17T21:42:16.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Schneider Electric has released firmware version 5.6.0 for its NetBotz 5 750 and 755 environmental and security monitoring appliances, fixing two vulnerabilities affecting all versions up to and including 5.5.2\. CVE-2026-13336 (CWE-78, OS command injection, CVSS 3.1 base score 6.4 MEDIUM, vector CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) allows execution of Linux operating system commands when a maliciously modified system backup is restored. CVE-2026-13337 (CWE-564, Hibernate SQL injection, CVSS 3.1 base score 4.6 MEDIUM, vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) allows injection of a malicious HQL query into the NetBotz database by an authenticated user via the web-service interface or web UI. No CISA-KEV exploitation state is recorded for either CVE in the verified reference data, and no exploitation has been reported in the source material. For EMEA financial services the exposure is concentrated in data centre and building-management deployments, where these appliances monitor temperature, humidity, leak, smoke, vibration, door contact and video; successful exploitation could give an attacker command execution on the local network segment and unauthorised access to monitoring and camera data.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerabilities are vendor-confirmed and fixed, with no reported exploitation, no incident, and no evidence of compromise at any client. The presence of an affected device in a data centre would be a routine patch-management matter under existing ICT asset-management processes rather than a trigger for incident classification or reporting under the articles in scope.

## 3\. Technical analysis & attack chain

Two vulnerabilities affect NetBotz 5 750 and NetBotz 5 755, versions 5.5.2 and prior. Both are fixed in version 5.6.0.

CVE-2026-13336, OS command injection (CWE-78), CVSS 3.1 6.4 MEDIUM, CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The appliance executes Linux operating system commands when it restores a system backup that has been maliciously modified. The vector confirms the preconditions: adjacent network (AV:A), high attack complexity (AC:H), and high privileges required (PR:H). The attack chain as described by the vendor is:

1. An attacker with privileged access to the appliance, or with the ability to plant a file, obtains or creates a NetBotz system backup file.
2. The backup file is modified to embed attacker-controlled content in the fields that the restore process passes to the operating system shell.
3. A restore of that backup is performed on the appliance.
4. The restore path executes the injected content as Linux OS commands on the device.

The vendor does not name the backup file format, the specific restore routine, or the command-injection sink, so the exact payload placement cannot be specified from the source. The impact is arbitrary command execution on the appliance, with high impact on confidentiality, integrity and availability of the device. The PR:H rating means the attacker needs privileged access to the appliance or its backup workflow before the injection matters, which shifts the practical risk toward a malicious insider, a compromised administrator account, or a poisoned backup repository rather than an opportunistic network attacker.

CVE-2026-13337, SQL injection in Hibernate (CWE-564), CVSS 3.1 4.6 MEDIUM, CVSS:3.1/AV:A/AC:L/AC:L/UI:N/S:U/C:L/I:L/A:N. A user logged into the NetBotz via the web-service interface or web UI can inject a malicious HQL query into the NetBotz database. The vector is adjacent network, low attack complexity, low privileges required, with low confidentiality and integrity impact and no availability impact. This is an authenticated injection: the attacker needs a valid, low-privileged account on the appliance. The vendor does not identify the vulnerable endpoint, parameter, or the HQL statement involved, so no specific payload or query structure can be given. Practical impact is limited to reading or modifying data in the appliance's own database, which holds monitoring configuration, alerting rules, user accounts and sensor/camera metadata.

Both vulnerabilities are single-sourced in effect: the CISA ICSA (ICSA-26-260-05) is a verbatim republication of the vendor's own advisory, Schneider Electric CPCERT SEVD-2026-223-02, so all technical detail traces to one origin. No independent technical analysis, proof of concept, or exploit code is referenced in the source material. No threat actor is named and no attribution claim exists to assess.

## 4\. Mitigation & containment

P1, within 24 hours: inventory data centre, server room and building-management estates for NetBotz 5 750 and 755 appliances and record their firmware versions. Log into the appliance GUI and check the "About NetBotz" option, which reports the installed version. Any device at 5.5.2 or below is affected.

P1, within 24 hours: upgrade affected appliances to version 5.6.0, downloadable from https://www.se.com/ww/en/product-range/61830-netbotz/#software-and-firmware. The install restarts the appliance automatically, so schedule the reboot for a maintenance window; the upgrade is validated afterwards by confirming 5.6.0 in the "About NetBotz" GUI option.

P2, within 72 hours: where the upgrade cannot be applied immediately, restrict network access to the NetBotz management interfaces so that only the monitoring and administration VLAN can reach them, and block all other source addresses at the segment firewall. The source gives no port list for NetBotz, so derive the allowed-port set from the appliance configuration rather than assuming defaults.

P2, within 72 hours: protect the backup and restore workflow for these appliances. Restrict who can download, store and restore NetBotz backup files, treat backup archives as sensitive configuration artefacts, and verify the provenance of any backup before restoring it to an appliance. A restore from an unverified source is the delivery path for CVE-2026-13336.

P2, within 72 hours: review local account usage on each appliance. CVE-2026-13337 requires only a low-privileged authenticated session, so remove dormant accounts, enforce unique credentials per appliance, and confirm that the web-service interface is not exposed beyond the administration segment.

P3, within 7 days: apply the vendor's general recommendations for ICS assets: isolate the monitoring network from the business network, place controllers in locked cabinets, and apply physical access controls so unauthorised personnel cannot reach the appliances. Report any suspected malicious activity on these devices to CISA for tracking and correlation, per the advisory.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The advisory describes vulnerabilities and a vendor fix only; it reports no exploitation, no malware, and no observable artefacts.

## 6\. Detection

Insufficient indicators to author detection rules. The source material names no command strings, file paths, process names, registry keys, network signatures or other artefacts of exploitation. Detection of CVE-2026-13336 restoration attempts and CVE-2026-13337 HQL injection would require the vulnerable endpoint and backup-handling details, which the vendor has not published.

## 7\. Sources

- CISA, Schneider Electric NetBotz 5 750/755, ICSA-26-260-05, https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-05, 2026-09-17 (republication of vendor advisory originally released 2026-08-11)
- Schneider Electric, Multiple Vulnerabilities on NetBotz 5 750/755 Products, SEVD-2026-223-02, referenced via the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-05

## 8\. Adverse Trace position

We assess this as a medium-severity patch item for EMEA financial services clients, not an active threat. Both CVEs are rated MEDIUM by the vendor, neither appears in CISA-KEV per the verified reference data, no exploitation has been reported, and both attack paths require an authenticated or privileged foothold on the appliance or its backup chain, which limits opportunistic risk. The devices sit in data centres and comms rooms where they monitor physical conditions and door contacts, so a compromised unit is a physical-security and monitoring-integrity problem as much as an IT one, and clients should treat the backup-restore path as a privileged operation. All technical detail here is single-sourced from the vendor advisory republished by CISA; we will monitor for independent analysis, proof-of-concept code, or KEV listing of CVE-2026-13336 and CVE-2026-13337, and will reissue this note if exploitation is observed.

---

[Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-05?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*