Schneider Electric NetBotz 5 Hit by OS, SQL Injection Flaws
The Hibernate SQL injection vector requires an authenticated session, but the OS command injection rides on a malicious backup restore, patch to v5.6.0 covers both.
TL;DR
CISA's ICS advisory covers two vulnerabilities in Schneider Electric NetBotz 5 750/755 environmental monitors, versions 5.5.2 and prior. CVE-2026-13336 allows OS command injection when a maliciously modified system backup is restored. CVE-2026-13337 enables HQL injection in the NetBotz database through the web interface, but only for an already-authenticated user. Schneider Electric has released version 5.6.0, which addresses both. No configuration workaround is offered. The advisory flags commercial facilities, critical manufacturing, and IT sectors as relevant.
Two injection flaws in the same device, two very different attack paths. The Schneider Electric NetBotz 5 750/755 (rack-mounted environmental monitors that track temperature, humidity, leaks, and door contacts) carries both an OS command injection (CVE-2026-13336, CVSS 6.4) and a Hibernate SQL injection (CVE-2026-13337, CVSS 4.6) in versions 5.5.2 and prior.
The OS command injection is the one worth moving on. It triggers when a system backup is restored from a maliciously modified file, giving an attacker Linux command execution on the device. The CVSS vector (adjacent network, high attack complexity, high privileges required) reflects that you need to get a bad backup onto the box first. But once you do, the impact is complete: high across confidentiality, integrity, and availability.
The SQL injection is less dramatic but still gaping for anyone already inside. CVE-2026-13337 lets an authenticated user inject malicious HQL queries through the web UI or web-service interface, pulling data from the NetBotz database. Adjacent network, low complexity, low privileges. It's a data exposure vector, not a takeover vector, unless the database holds credentials or network topology details that make pivoting easy.
What the advisory doesn't say
Schneider Electric reported both to CISA through its own CPCERT. There's no mention of active exploitation, and no mitigation short of upgrading. No configuration changes, no firewall rules, no network segmentation play that closes either hole. The remediation section points to the v5.6.0 download on Schneider's site, notes the device auto-reboots on install, and tells you to check the "About NetBotz" screen to confirm.
Practitioner Monday
If you're running NetBotz 5 750/755 units on a segmented OT or facilities network, the upgrade is your only path. The backup-restore vector on CVE-2026-13336 means you'll also want to audit who can push backup files to these devices, the CVSS assumes high privileges, but if restore access is broader in your environment than Schneider assumes, your risk is higher than the 6.4 suggests.
For the SQL injection, the constraint is the authenticated-session requirement. That's not nothing, but on a device where default credentials persist or where credential sharing across a facilities team is common, it's a thin gate.
Published ·Deep Fathom