Schneider NetBotz EUVD-2026-69134

Exploitation requires all three of the following: (1) the attacker holds a valid low-privilege account on the NetBotz 5 750/755 appliance (PR:L confirmed by CVSS); (2) the attacker is positioned on the same adjacent network segment as the appliance (AV:A - internet-based remote exploitation is structurally excluded); (3) the attack is delivered through the appliance's web service interface or web UI, both of which must be reachable from the attacker's position. Limiting factors: unauthenticated exploitation is not possible; the adjacent-network constraint rules out opportunistic internet scanning; impact is bounded to partial confidentiality and integrity on the NetBotz database with no availability disruption, limiting the usefulness of exploitation to intelligence gathering or minor data manipulation.

The vendor-supplied CVSS 4.0 vector AV:A/AC:L/AT:N/PR:L/UI:N with impacts VC:L/VI:L/VA:N yields a score of 5.1 (Medium), which accurately reflects the bounded threat. The adjacent-network attack vector (AV:A) is a significant limiter - internet-based opportunistic exploitation is structurally impossible. PR:L confirms a valid credential is required, further constraining the threat to insiders, credential-holding contractors, or lateral-movement scenarios from a compromised adjacent host. Confidentiality and integrity impacts are limited to the NetBotz database; availability is unaffected. No KEV listing and no POC exist, so there is no evidence of active or imminent exploitation. The primary realistic risk is a malicious insider or a pivoting attacker who has already compromised another host on the same OT/physical-security network segment.

An attacker holding a valid low-privilege NetBotz account - such as an insider, a contractor, or a threat actor who has pivoted from a compromised host on the same network segment - logs into the appliance web UI or web service interface and submits a crafted input field value containing HQL metacharacters. The malformed query alters the intended database operation, returning unauthorized records such as sensor configurations, access event logs, or credential data stored in the NetBotz database. No public exploit code has been identified at time of analysis.