Description
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | PowerChute™ Serial Shutdown | Versions v1.3 and prior | — |
Advisories 2
- ICSA-25-322-04 Schneider Electric PowerChute Serial Shutdown CISA ICS & IT advisories · Nov 11, 2025
- SEVD-2025-315-01 PowerChute™ Serial Shutdown Schneider Electric CPCERT · Nov 11, 2025