Summary
Schneider Electric is aware of a vulnerability in its PowerChute Serial Shutdown product.
The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown
and energy management capabilities for desktop, servers and workstations.
Failure to apply the fix provided below may risk a Denial of Service attack, which could result in an attack that
blocks access for the single user account to PCSS Web UI. The PCSS application itself is not affected and
PCSS will keep protecting the server.
Vulnerabilities 1
-
Medium 5.3CVE-2024-10511 Public exploit
CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someo…
Revision history
-
#1.0.0
Original Release
References
-
PowerChute Serial Shutdown - SEVD-2024-345-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2024-345-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390
-
ICS Advisory ICSA-25-010-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-01
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B