Summary
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product.
The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations.
Failure to apply the remediation provided below may risk improper authentication validation which could result in disruption of operations and access to system data.
Vulnerabilities 1
-
Medium 6.9
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to…
Revision history
-
#2
Initial CISA Republication of Schneider Electric CPCERT SEVD-2026-223-01 advisory
-
#1
Original Release
References
-
Improper Restriction of Excessive Authentication Attempts vulnerability on PowerChute Serial Shutdown - SEVD-2026-223-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-223-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390
-
ICS Advisory ICSA-26-260-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-07
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b