Schneider Electric NetBotz 5 750/755 Flaws Enable Command Injection and SQL Injection

Schneider Electric has published a security advisory (SEVD-2026-223-02) detailing multiple vulnerabilities in its NetBotz 5 750 and 755 products, which are security and environmental monitors used in critical infrastructure sectors including commercial facilities, critical manufacturing, and information technology. The advisory, coordinated with CISA, affects all versions up to and including 5.5.2 of both models.

The first vulnerability, CVE-2026-13336, is an OS command injection flaw (CWE-78) that could allow an attacker to execute Linux operating system commands when a maliciously modified system backup is restored. The second, CVE-2026-13337, is a SQL injection vulnerability in Hibernate (CWE-564) that permits the injection of malicious HQL queries into the NetBotz database when a user is logged into the web-service interface or web UI.

Both vulnerabilities have been assigned medium severity ratings. CVE-2026-13336 carries a CVSS v3.1 base score of 6.4 (vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), while CVE-2026-13337 has a score of 4.6 (vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The attack vector for both is adjacent network, meaning an attacker would need to be on the same local network as the device.

Schneider Electric has released firmware version 5.6.0 for both NetBotz 5 750 and 755, which includes fixes for these vulnerabilities. The update is available for download from the vendor's product page. After installation, the device will automatically restart, and users can verify the update by checking the 'About NetBotz' option in the GUI.

The advisory also includes general security recommendations, such as placing control and safety system networks behind firewalls, isolating them from business networks, and implementing physical controls to prevent unauthorized access.

As of the advisory's publication, there is no public evidence of active exploitation of these vulnerabilities. However, given the critical nature of the affected devices in industrial environments, organizations are urged to apply the firmware update promptly.