CVE-2022-34753: Schneider SpaceLogic C-Bus Home Controller OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote root command injection with a public exploit and very high EPSS, though it requires low-privileged authentication and is not in KEV.

What it is

The SpaceLogic C-Bus Home Controller (5200WHC2, formerly C-Bus Wiser Home Controller MK2) fails to neutralize special elements in OS commands, allowing command injection. Successful exploitation yields remote root on the controller, a building-automation device.

Impact

An attacker gains remote root execution on the controller, enabling full control of the device and any building systems it manages.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but requires low-privileged authentication (PR:L).

Exploitation

Not listed in CISA KEV, but EPSS is 0.71284 (99.38th percentile) and a public Packet Storm exploit reference exists, indicating active interest and available exploit code.

What to do

• Apply the Schneider Electric security notification SEVD-2022-193-02 patch for the SpaceLogic C-Bus Home Controller / Wiser MK2.
• Restrict network access to the controller to trusted management segments and block internet exposure.
• Change default and weak credentials and enforce least-privilege accounts on the device.
• Monitor the vendor advisory for updated firmware and re-apply if a newer fix is released.

Detection

• Alert on unexpected outbound connections or shell activity from the controller.
• Monitor controller logs for command execution anomalies or unusual authenticated sessions.
• Watch for known exploit traffic patterns against the controller's web interface.
• Baseline normal controller behavior and flag deviations in process or network activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.