CVE-2026-13337: CWE-564 SQL injection: hibernate in Schneider Electric NetBotz 5 - 750/755

This vulnerability is a CWE-564 SQL injection in the Hibernate layer of Schneider Electric NetBotz 5 - 750/755 devices. It allows an authenticated user with low privileges to inject malicious HQL queries through the web-service interface or web UI, potentially compromising the integrity of the NetBotz database. The CVSS 4.0 base score is 5.1, reflecting medium severity with attack vector as adjacent network and low privileges required. No known exploits are reported in the wild, and no vendor remediation or patch information is provided at this time.

An authenticated user with low privileges can inject malicious HQL queries into the NetBotz database, potentially leading to unauthorized data manipulation or corruption within the device's database. The impact is limited by the requirement for user login and the adjacent network attack vector, reducing the risk of remote exploitation without access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the NetBotz web-service interface and web UI to trusted users only, and monitor for suspicious activity from authenticated users. Follow Schneider Electric's official advisories for updates.