Medium severity · published Sep 1, 2026
CVE-2026-13337
CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the…
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N5
NetBotz 5 - 750/755 · Schneider Electric
Versions 5.5.2 and prior · source: vendor
In the news
VulnerabilityHigh
Schneider Electric NetBotz 5 750/755
View CSAF
Summary
Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities. Failure to apply the remediation provided below may risk arbitrary or remote code execution over the local network, which could result in device manipulation and unauthorized data access.
The following versions of Schneider Electric NetBotz 5 750/755 are affected:
NetBotz 5 750 vers:intdot/<=5.5.2 (CVE-2026-13336, CVE-2026-13337)
NetBotz 5 755 vers:intdot/<=5.5.2 (CVE-2026-13336, CVE-2026-13337)
CVSS
Vendor
Equipment
Vulnerabilities
v3 6.4
Schneider Electric
Schneider Electric NetBotz 5 750/755
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), SQL Injection: Hibernate
Background
Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Information Technology
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France
Vulnerabilities
Expand All +
CVE-2026-13336
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified.
View ...
Sep 17, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13337
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13337
download.se.com
https://download.se.com/files?p_Doc_Ref=SEVD-2026-223-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-223-02.pdf
More from NetBotz 5 - 750/755
7.3
CVE-2026-13336
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system…
