CVE-2025-9996 Details
Description
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any shell command when executing a netstat command using BLMon Console in an SSH session.
A command injection vulnerability has been identified in Schneider Electric's Saitel DR and Saitel DP Remote Terminal Units (RTUs), in versions through 11.06.29 for Saitel DR and through 11.06.33 for Saitel DP. This vulnerability, categorized as CWE-78, allows the execution of arbitrary shell commands by injecting commands through the BLMon Console during an SSH session. The issue arises when the netstat command is executed, creating an opportunity for command injection that could lead to unauthorized code execution on the device.
Users of Saitel DR RTU should upgrade to firmware version 11.06.30, while Saitel DP RTU users should upgrade to version 11.06.34. Both firmware versions include a fix for this vulnerability. After upgrading, a reboot is required to complete the process. For those who choose not to apply the update, it is recommended to restrict access to the BLMon Console by limiting permissions to a select group of user roles, ensure users have the least privileged role necessary for their tasks, and implement firewall rules to limit SSH access to the device.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2025CISA-ADP
Assessed Sep 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-252-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-252-02.pdf | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Schneider Electric Saitel DR RTU | <= 11.06.29 (semver) |
CPE
Remediation
| |
| Schneider Electric Saitel DP RTU | <= 11.06.33 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2025 | New CVE Received | [email protected] |