Loading story…
Schneider Electric disclosed a high-severity vulnerability affecting NetBotz 5 750 and NetBotz 5 755 appliances running version 5.5.2 and earlier. According to national CERT and CSIRT notices, successful exploitation could allow a malicious user to execute arbitrary code on impacted systems, creating a significant risk for organizations that use the devices for environmental monitoring and physical security in operational environments.
Government advisories from Paraguay's CERT and Italy's ACN/CSIRT Italia directed defenders to Schneider Electric's security bulletin for remediation and mitigation guidance. Organizations using affected NetBotz products have been urged to identify exposed or deployed units, review Schneider Electric's recommended mitigations, and apply vendor-provided fixes to reduce the risk of compromise.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity vulnerability affecting Schneider Electric NetBotz 5 750 and NetBotz 5 755 devices running version 5.5.2 and earlier was identified. If exploited, the flaw could allow arbitrary code execution, and Schneider Electric provided mitigations in its security bulletin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Schneider Electric disclosed vulnerabilities affecting **NetBotz 5 750/755** devices running version **5.5.2 or earlier** and **PowerChute Serial Shutdown** version **1.5 or earlier**. The NetBotz devices are affected by multiple unspecified vulnerabilities, while PowerChute Serial Shutdown contains an improper restriction of excessive authentication attempts flaw that could permit repeated authentication attempts. The Canadian Centre for Cyber Security issued advisory **AV26-871**, directing organizations using the affected products to review Schneider Electric security notices **SEVD-2026-223-01** and **SEVD-2026-223-02**, apply the vendor’s recommended mitigations, and install available updates. Administrators should identify exposed or operationally critical deployments and prioritize remediation to reduce the risk of unauthorized access or disruption.
Sep 2, 2026
Schneider Electric published a set of security advisories covering multiple **EcoStruxure** and **Modicon** product lines, with impacts ranging from remote code execution to loss of confidentiality and integrity and security policy bypass. Affected products named across the notices include **EcoStruxure Foxboro DCS**, **EcoStruxure Automation Expert**, **EcoStruxure IT Data Center Expert**, **EcoStruxure Power Monitoring Expert**, **EcoStruxure Power Operation Advanced Reporting and Dashboards Module**, and several **Modicon PLC** families. National cyber agencies in Canada and France urged organizations to review Schneider Electric bulletins and apply vendor-provided mitigations and updates. One of the disclosed issues, tracked by CISA for **EcoStruxure Foxboro DCS**, is a **deserialization of untrusted data** flaw (`CWE-502`) affecting workstation and server components in versions prior to `CS8.1`; Schneider said Control Core Services and runtime components such as FCPs, FDCs, and FBMs are not affected. The vulnerability can enable loss of confidentiality and integrity and possible remote code execution if an administrator-authenticated user opens a malicious project file on a vulnerable workstation. The broader March advisory set references **`CVE-2025-11739`**, **`CVE-2025-13957`**, **`CVE-2026-1286`**, and **`CVE-2026-2273`**, and defenders are being told to prioritize patching alongside standard ICS protections such as network segmentation, firewalling, restricted access, and secured remote connectivity.
Jun 29, 2026
CERT-FR issued advisories for multiple vulnerabilities affecting **Belden NetModule Router Software** and a range of **Siemens** products. The flaws in Belden NetModule Router Software could allow a remote attacker to execute arbitrary code on affected systems and trigger a remote denial of service, raising concern for organizations that rely on these devices in operational and industrial environments. A separate CERT-FR notice reported multiple vulnerabilities across Siemens products that could enable **remote code execution**, **privilege escalation**, and **remote denial of service**. While the available notice summary did not list specific product names, `CVE` identifiers, or patch details, the combined disclosures indicate broad exposure across industrial technology vendors and underscore the need for defenders to identify affected assets and apply vendor guidance as updates become available.
Jun 29, 2026