CVE-2026-13336: Schneider NetBotz 5 OS Command Injection via Backup

CVE-2026-13336 is an OS command injection vulnerability (CWE-78) in Schneider Electric's NetBotz 5 – 750/755, a physical appliance that monitors data-center and industrial facility conditions such as temperature, humidity, leaks, smoke, vibration, door contacts, and video: restoring a system backup file that has been maliciously modified causes the device to execute Linux operating-system commands, and NVD has not, as of 2026-11-07, published its own Primary CVSS score, so this page shows the vendor's own rating instead.

CVE-2026-13336 (CWE-78, OS command injection) affects Schneider Electric's NetBotz 5 – 750 and 755, described by Schneider as "security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities" for data-center and industrial facilities. NVD's description states: "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified" (NVD).

NVD tracks the CVE with status "Awaiting Analysis" as of 2026-09-01: it records only a Schneider Electric CPCERT-submitted score (source [email protected]) — CVSS v4.0 7.3 (high), vector CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — typed Secondary. Schneider's own advisory additionally lists a CVSS v3.1 score of 6.4 (medium), vector CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, for the same flaw; neither figure is an NVD-published Primary rating, so this page does not show a single NVD-confirmed headline score (NVD).

CISA's advisory ICSA-26-260-05 is, per its own disclaimer, "a verbatim republication of Schneider Electric CPCERT SEVD-2026-223-02"; it documents a companion flaw in the same appliance, CVE-2026-13337 (CWE-564, Hibernate SQL injection): "a malicious user... logged into the NetBotz via the web-service interface or web-ui" can inject a crafted HQL query into the NetBotz database, rated CVSS v3.1 4.6 / v4.0 5.1. CISA states that "failure to apply the remediation provided below may risk arbitrary or remote code execution over the local network," and lists the Commercial Facilities, Critical Manufacturing, and Information Technology sectors with worldwide deployment (CISA ICS Advisory ICSA-26-260-05).

Schneider Electric's remediation is version 5.6.0 of NetBotz 5 – 750/755, which the vendor states fixes both CVE-2026-13336 and CVE-2026-13337 and restarts the appliance automatically on install; both issues were found internally by Schneider Electric rather than reported by an outside researcher (CISA ICS Advisory ICSA-26-260-05).

Neither CVE-2026-13336 nor CVE-2026-13337 is listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores CVE-2026-13336's exploitation probability at 0.01572 (75.5th percentile) as of 2026-11-06 — notably higher than most newly disclosed ICS flaws, despite the lack of any confirmed in-the-wild activity (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. Operators of NetBotz 5 – 750/755 appliances should update to version 5.6.0, and treat the integrity of any backup file before restoring it as a security-sensitive step, not just an operational one.

• Restoring a maliciously modified system backup on NetBotz 5 – 750/755 causes execution of Linux operating-system commands (CWE-78, OS command injection). — NVD
• NVD status "Awaiting Analysis" with a Schneider Electric CPCERT Secondary CVSS v4.0 7.3; Schneider's own advisory separately lists CVSS v3.1 6.4 for the same flaw. No NVD-published Primary score as of 2026-09-01. — NVD
• Companion CVE-2026-13337 (CWE-564, Hibernate SQL injection) lets a logged-in user inject a malicious HQL query via the NetBotz web-service interface or web UI, CVSS v3.1 4.6 / v4.0 5.1. Advisory is a verbatim republication of Schneider Electric CPCERT SEVD-2026-223-02. Affects Commercial Facilities, Critical Manufacturing, and Information Technology sectors worldwide. — CISA ICS Advisory ICSA-26-260-05
• Fix is NetBotz 5 – 750/755 version 5.6.0, which restarts the appliance automatically on install; both CVE-2026-13336 and CVE-2026-13337 were found internally by Schneider Electric. — CISA ICS Advisory ICSA-26-260-05
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01572 (75.5th percentile) as of 2026-11-06. — FIRST EPSS