EUVD-2026-69132
GHSA-hf2q-8x2f-8fwp
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector with high complexity (AT:P precondition maps to AC:H) and high privileges required to initiate restore; no scope change as subsequent systems are unaffected.
Primary rating from Vendor (schneider).
CVSS VectorVendor: schneider
Lifecycle Timeline
2DescriptionCVE.org
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified.
AnalysisAI
OS command injection in Schneider Electric NetBotz 5 (models 750 and 755) environmental monitoring appliances allows arbitrary Linux OS command execution when a system backup that has been maliciously modified is restored on the device. Exploitation requires high-privilege administrative access and adjacent network positioning, substantially narrowing the realistic threat population to insiders or supply-chain compromise scenarios. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Valid administrative (high-privilege) credentials on the NetBotz 5 750/755 management interface, as confirmed by PR:H in the CVSS 4.0 vector - unauthenticated or low-privilege attackers cannot trigger the restore process; (2) The ability to supply or tamper with a backup file prior to initiating restore, since the malicious payload is embedded in the backup artifact itself (AT:P confirms this specific precondition); (3) Adjacent network access to the device management interface (AV:A), excluding internet-sourced attacks without network adjacency. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:H/VC:H/VI:H/VA:H) encodes several meaningful constraints that reduce real-world risk below what the 7.3 score alone might suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Schneider Electric security advisory SEVD-2026-223-02 (https://download.se.com/files?p_Doc_Ref=SEVD-2026-223-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-223-02.pdf) for confirmed patch versions and upgrade instructions; a specific fixed firmware version was not independently derivable from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all NetBotz 5 models (750/755) in production environments; audit backup storage, access controls, and personnel with restoration privileges to establish baseline exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Netbotz 5 750 755
View allSame weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today