Restoring a tampered NetBotz backup runs Linux commands on Schneider's data center monitor

The restore path is the one to read closely. CISA's advisory says the OS command injection fires when a system backup that has been maliciously modified is restored, and the result is execution of Linux operating system commands on the monitor ^[3]. The advisory does not say what privilege a restore requires. That gap decides how the bug rates: a restore any authenticated operator can run is a different problem from one locked to an administrator.

Schneider's own description of the second flaw puts it behind a login, where a malicious user signed into NetBotz through the web-service interface or the web UI injects a malicious HQL query into the device database ^[4].

NetBotz 5 units report temperature, humidity, leak, smoke, vibration and door contact state, and they also carry video ^[1]. CISA puts the impact as arbitrary or remote code execution over the local network, leading to device manipulation and unauthorized data access ^[2]. The advisory lists Commercial Facilities, Critical Manufacturing and Information Technology as the affected sectors and says deployment is worldwide ^[10].

Schneider's NetBotz software and firmware download page carries version 5.6.0, the fix ^[6]. The install restarts the appliance automatically, and the installed version shows under the About NetBotz option in the GUI ^[7]. Both CVE IDs, CVE-2026-13336 and CVE-2026-13337, are listed against both models and against both vulnerability entries, so neither ID is tied to the command injection or to the SQL injection ^[13]. CISA left CVSS scores off both entries ^[12].

For a defender ordering the week, the exploitability here is bounded by access. Each path needs something first: one wants a login, the other wants a doctored archive that somebody restores. The doctored-archive case is the cheaper of the two for an attacker who already has a foothold on the management network, because a NetBotz configuration backup is an ordinary file that lives wherever the operator put it, and restoring it is a routine act by someone with no reason to inspect the contents.

Schneider Electric's CPCERT reported both vulnerabilities to CISA ^[8], and the vendor tracks them as SEVD-2026-223-02 under CISA advisory ICSA-26-260-05 ^[9]. Schneider's standing guidance for these products is to keep control and safety networks behind firewalls, isolated from the business network, off the internet, with VPNs where remote access is required ^[11].