CVE-2022-34753

What it actually does

This is an OS command injection vulnerability in Schneider Electric SpaceLogic C-Bus Home Controller / C-Bus Wiser Home Controller MK2 firmware version 1.31.460 and earlier. A network-reachable, authenticated attacker with low privileges can supply specially crafted input that is passed unsafely into an operating-system command. Because the affected command path can execute with root privileges, successful exploitation can result in arbitrary command execution as root, allowing full compromise of the controller including file access, configuration changes, service manipulation, persistence, and disruption of automation functions.

Why it matters to the business

Successful exploitation can give an attacker complete administrative control of an affected home or building automation controller. This can disrupt lighting, automation, scheduling, monitoring, and other connected control functions, and may provide a foothold into adjacent networks if the controller is reachable from broader enterprise or remote-access networks. The issue has a high exploitation likelihood signal, weaponized exploit maturity, and has been public for several years, so unpatched exposed systems should be treated as high-priority remediation targets even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed or reachable affected controller running firmware version 1.31.460 or earlier. Because the vulnerability requires low privileges, the attacker needs valid access to the controller through a default, reused, phished, leaked, or otherwise compromised account. After authenticating, the attacker sends crafted input to a vulnerable function that incorporates user-controlled data into a shell command without adequate neutralization. Shell metacharacters or command separators cause the device to execute attacker-supplied commands in the context of the vulnerable process, which can lead to root-level command execution. The attacker may then download tooling, modify startup scripts or configuration, create backdoor access, alter automation behavior, pivot to other reachable systems, or render the controller unavailable.

How to fix it

Upgrade affected Schneider Electric SpaceLogic C-Bus Home Controller / C-Bus Wiser Home Controller MK2 devices running version 1.31.460 or earlier to a vendor-fixed firmware release when available, following Schneider Electric guidance for this vulnerability. If using source or package metadata that identifies nextcloud/desktop, ensure builds include commit e03ab5cf907b51a3cada715fa5831ae44e1e19b7; however, validate product applicability because the vulnerability description identifies Schneider Electric controller firmware. Until patching is complete, restrict management access to trusted administration networks only, block Internet exposure, require VPN or jump-host access for administration, rotate controller credentials, remove default or shared accounts, disable unused services, and monitor for signs of command execution or unauthorized configuration changes. If compromise is suspected, preserve logs where possible, disconnect the device from untrusted networks, reimage or factory-reset according to vendor guidance, update firmware, and restore only trusted configurations.

How to confirm the fix worked

Inventory deployed controllers and verify model and firmware version through the management interface, device configuration export, vendor tooling, or network asset inventory. Confirm no SpaceLogic C-Bus Home Controller / C-Bus Wiser Home Controller MK2 devices remain on version 1.31.460 or earlier. Validate that administrative interfaces are not reachable from the public Internet and are limited to approved management networks. After remediation, perform an authenticated configuration review to confirm firmware version, account list, remote-access settings, and startup configuration. Where safe and authorized, use vulnerability scanning or vendor-provided checks to confirm the vulnerable firmware is no longer present; avoid destructive exploit validation against operational automation devices.

Typical attack path

1. Discover Internet-exposed or internally reachable SpaceLogic C-Bus Home Controller / C-Bus Wiser Home Controller MK2 devices.
2. Confirm the device is running affected firmware version 1.31.460 or earlier.
3. Obtain low-privileged authenticated access using stolen, weak, default, or reused credentials.
4. Submit crafted input containing shell metacharacters to the vulnerable command-handling functionality.
5. Achieve arbitrary command execution with root privileges on the controller.
6. Establish persistence or retrieve sensitive configuration, credentials, logs, and network information.
7. Manipulate automation functions, disrupt services, or use the controller as a foothold for lateral movement.

How to detect it

Review device authentication logs, web management logs, syslog output, firewall logs, VPN logs, and network telemetry for signs of suspicious authenticated activity followed by command execution or outbound downloads. Focus on requests containing shell metacharacters such as semicolons, pipes, backticks, command substitution, redirection, encoded command separators, or common Linux utility names. Look for successful logins from unusual IP addresses, new or modified administrator accounts, unexpected firmware or configuration changes, service restarts, and connections from the controller to unfamiliar external hosts. On the device, where forensic access is supported, inspect writable directories and startup locations for unauthorized scripts, binaries, cron entries, modified init files, or added SSH/Telnet services. Because the device may have limited logging and attackers may erase artifacts, correlate controller logs with perimeter firewall, DNS, DHCP, NAC, proxy, and remote-access logs over the full suspected exposure window.

• ;wget
• ; curl
• |wget
• | curl
• && wget
• && curl
• `wget
• `curl
• $(wget
• $(curl
• /bin/sh
• /bin/ash
• /bin/busybox
• busybox wget
• busybox nc
• nc -e
• telnetd
• dropbear
• chmod +x
• /tmp/
• /var/tmp/
• /dev/shm/
• crontab -e
• /etc/init.d/
• /etc/rc.local
• uid=0(root)
• GET *;* HTTP
• POST *;* HTTP
• %3Bwget
• %3Bcurl
• %7Cwget
• %7Ccurl
• %26%26wget
• %26%26curl
• %60wget
• %60curl
• %24%28wget
• %24%28curl

What your security team should do

• Treat exposed or remotely reachable affected controllers as urgent due to weaponized exploit maturity and high EPSS probability.
• Immediately remove affected controller management interfaces from direct Internet exposure and restrict access to trusted administrative networks.
• Upgrade Schneider Electric SpaceLogic C-Bus Home Controller / C-Bus Wiser Home Controller MK2 firmware beyond version 1.31.460 using vendor-approved firmware and procedures.
• Rotate all controller credentials, remove default accounts, and review account activity for unexpected logins before and after patching.
• Search historical logs, firewall records, proxy records, and device logs for suspicious authenticated requests containing shell metacharacters or command execution patterns.
• Review affected devices for persistence mechanisms, unauthorized configuration changes, unknown files in writable directories, and unexpected outbound network connections.
• If exploitation is suspected, isolate the controller, preserve evidence, rebuild or factory-reset from trusted media, update firmware, and restore a known-good configuration.
• Segment building automation and IoT control networks from user workstations, servers, and the Internet to reduce blast radius.
• Add monitoring for anomalous outbound connections from controller networks, especially downloads of binaries or connections to unfamiliar external hosts.