Summary
Schneider Electric is aware of a vulnerability in its PowerChute™ Serial Shutdown product.
The [PowerChute™ Serial Shutdown](https://www.se.com/us/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system
shutdown and energy management capabilities for desktop, servers and workstations.
Failure to apply the mitigations or remediations provided below may risk elevation of privileges or
unauthenticated access which could result in disruption of operations and access to system data.
Vulnerabilities 3
-
High 7.3
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could …
-
High 7.3
CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target ins…
-
Medium 6.9
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on…
Revision history
-
#1.0.0
Original Release
References
-
PowerChute™ Serial Shutdown - SEVD-2025-315-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-25-322-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-04
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b