Summary
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product.
The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown
and energy management capabilities for desktop, servers and workstations.
Failure to apply the remediation provided below may risk improper input validation which could result in
disruption of operations and access to system data.
Vulnerabilities 7
-
Medium 6.9
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could c…
-
Medium 6.9
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to …
-
Medium 6.9
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when…
-
Medium 5.3
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application u…
-
Medium 5.3
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log tr…
-
Medium 5.3
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file crea…
-
Low 2.4
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information…
Revision history
-
#2
Initial CISA Republication of Schneider Electric CPCERT SEVD-2026-104-01 advisory
-
#1
Original Release
References
-
Multiple Vulnerabilities on PowerChute™ Serial Shutdown - SEVD-2026-104-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-26-190-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b