Medium severity · published Sep 9, 2025
CVE-2025-9997
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLMon that is…
5.8
CVSS
0.5%
EPSS
No
On KEV
Description
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Saitel DP RTU · Schneider Electric
all versions through 11.06.33 · source: vendor
SD
Saitel DR RTU · Schneider Electric
all versions through 11.06.29 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9997
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-252-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-252-02.pdf
More from Saitel DP RTU
6.7
CVE-2025-8453
CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user with console access…
5.8
CVE-2025-9996
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any shell command when…