CVE-2026-13337: Schneider Electric NetBotz 5 750/755 OS command injection and SQL injection

CVE-2026-13337 · Severity: high · CVSS 6.4 · Published 2026-09-01

Schneider Electric NetBotz 5 750/755 is a security and environmental monitoring system used to track temperature, humidity, leaks, smoke, and video in data centers and facilities. The devices contain two critical vulnerabilities that allow attackers with local network access to execute arbitrary system commands or inject malicious database queries, potentially leading to unauthorized control of the monitoring system and access to sensitive environmental and security data.

Vendors: Schneider Electric.

Quick answers

Is CVE-2026-13337 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13337 being exploited in the wild.
How severe is CVE-2026-13337?
High severity, with a CVSS score of 6.4, published 1 September 2026.
Which products and versions are affected?
Schneider Electric NetBotz 5 750 <=5.5.2; Schneider Electric NetBotz 5 755 <=5.5.2.
Is there a fix for CVE-2026-13337?
A patch was published on 2026-09-17: Schneider Electric released NetBotz 5 version 5.6.0 containing fixes for both CVE-2026-13336 and CVE-2026-13337 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13337 attacked?
It is attacked over the network or from the adjacent network or with local access, in a network appliance.
Am I affected by CVE-2026-13337?
Check whether you run Schneider Electric NetBotz 5 750 or Schneider Electric NetBotz 5 755 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-13336 is an OS command injection vulnerability (CWE-78) that arises when a maliciously modified system backup is restored to the NetBotz device, allowing execution of arbitrary Linux operating system commands. CVE-2026-13337 is a SQL injection vulnerability in the Hibernate ORM layer (CWE-564) that permits injection of malicious HQL queries when an authenticated user interacts with the device via the web service or web UI. Both vulnerabilities require local network access; the command injection requires high privileges and backup manipulation, while the SQL injection requires an authenticated user. Successful exploitation can result in device manipulation and unauthorized access to monitoring data. Patches are available in NetBotz 5 version 5.6.0 and later.

Affected products

  • Schneider Electric NetBotz 5 750 <=5.5.2
  • Schneider Electric NetBotz 5 755 <=5.5.2

Identifiers

  • CVE-2026-13337
  • CVE-2026-13336

Timeline

  • 2026-09-17: disclosed: CISA ICS Advisory ICSA-26-260-05 published
  • 2026-09-17: patched: Schneider Electric released NetBotz 5 version 5.6.0 containing fixes for both CVE-2026-13336 and CVE-2026-13337

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.