Schneider Electric NetBotz 5 750/755: 2 CVEs, Medium 6.4
Summary
CISA reports 2 vulnerabilities in Schneider Electric NetBotz 5 750, NetBotz 5 755. Weakness types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), SQL Injection: Hibernate. Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities.Failure to apply the… Highest CVSS v3 score: 6.4 (Medium), exploitable from an adjacent network.
At a glance
- Vendor
- Schneider Electric
- Products
- NetBotz 5 750, NetBotz 5 755
- CVEs
- CVE-2026-13336, CVE-2026-13337
- Highest CVSS v3
- 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Critical Manufacturing, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- France
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-13336 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 6.4 | – | No | CVE-2026-13336 |
| CVE-2026-13337 | SQL Injection: Hibernate | 4.6 | – | No | CVE-2026-13337 |
Affected products (4)
- NetBotz 5 750 versions 5.5.2 and prior
- NetBotz 5 755 Versions 5.5.2 and prior
- NetBotz 5 750 Version 5.6.0
- NetBotz 5 755 Version 5.6.0
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Version 5.6.0 of NetBotz 5 750/755 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/us/en/product-range/61830-netbotz/#software-and-firmware Reboot needed: Upon install, the offer will automatically restart. A customer can validate a successful install by logging into the GUI and selecting the ‘About NetBotz’ option. This will indicate the installed version. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-260-05
- Machine-readable CSAF record
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-02&p_enDocType=Secur
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-02&p_enDocType=Secur
- https://www.se.com/ww/en/download/document/7EN52-0390/
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.