NetBotz 5 750/755 CVE-2026-13336

Exploitation requires all of the following: (1) Valid administrative (high-privilege) credentials on the NetBotz 5 750/755 management interface, as confirmed by PR:H in the CVSS 4.0 vector - unauthenticated or low-privilege attackers cannot trigger the restore process; (2) The ability to supply or tamper with a backup file prior to initiating restore, since the malicious payload is embedded in the backup artifact itself (AT:P confirms this specific precondition); (3) Adjacent network access to the device management interface (AV:A), excluding internet-sourced attacks without network adjacency. Default configurations are not exploitable remotely without satisfying all three conditions simultaneously. The key limiting factors are mandatory administrative authentication, adjacency network requirement, and the necessity to physically or logically compromise the backup file integrity before the restore is triggered.

The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:H/VC:H/VI:H/VA:H) encodes several meaningful constraints that reduce real-world risk below what the 7.3 score alone might suggest. The attack vector is adjacent-network only, excluding opportunistic internet-based exploitation. High privileges (PR:H) are required to initiate a backup restore, meaning valid administrative credentials must already be compromised or held by the attacker. The AT:P condition further requires that a maliciously crafted backup file be present before the exploit trigger is pulled - this is not a fire-and-forget network exploit but a multi-step, access-dependent operation. No EPSS score, CISA KEV listing, or public POC has been provided, and no public exploitation activity is confirmed. Despite C/I/A rated High for the vulnerable system, the realistic threat population is limited to insiders, compromised admin accounts, or supply-chain scenarios where backup file integrity is not enforced - a profile more consistent with targeted attack than opportunistic mass exploitation.

An attacker who has obtained administrative credentials for a NetBotz 5 750/755 device - whether through phishing, credential reuse, or insider access - crafts or tampers with a system backup file by embedding shell metacharacters and malicious command syntax within parsed fields. The attacker uploads or stages this modified backup and initiates a restore operation from the adjacent network; during the restore, the injected OS commands execute on the underlying Linux system with the privileges of the restore process, granting arbitrary code execution on the appliance.