Schneider Electric PowerChute Serial Shutdown
Schneider Electric is aware of a vulnerability in its PowerChute™ Serial Shutdown product. The [PowerChute™ Serial Shutdown](https://www.se.com/us/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations. Failure to apply the mitigations or remediations provided below may risk elevation of privileges or unauthenticated access which could result in disruption of operations and access to system data.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-11567US | —OT elevated | — | ||
CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured. | ||||
| CVE-2025-11566US | — | — | ||
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by perf… | ||||
| CVE-2025-11565US | — | — | ||
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the loc… | ||||
references
External citations — patches, advisories, analysis.
- PowerChute™ Serial Shutdown - SEVD-2025-315-01 PDF Versionself
- PowerChute™ Serial Shutdown - SEVD-2025-315-01 CSAF Versionself
- ICS Advisory ICSA-25-322-04 JSONself
- ICS Advisory ICSA-25-322-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationPowerChute™ Serial Shutdown
To ensure remediation of CVE-2025-11567, Customers should immediately apply the following steps. If PowerChute is installed in a custom folder, ensure that the required permissions are set on the custom folder. NOTE: It is recommended to set administrative permissions on the custom folder. Specific instructions for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN - FixedPowerChute™ Serial Shutdown
Version v1.4 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: Linux: https://www.se.com/ww/en/download/document/SPD PCSS_LNX_EN/
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - FixedPowerChute™ Serial Shutdown
Version v1.4 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: Linux: https://www.se.com/ww/en/download/document/SPD PCSS_LNX_EN/
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - FixedPowerChute™ Serial Shutdown
Version v1.4 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: Linux: https://www.se.com/ww/en/download/document/SPD PCSS_LNX_EN/
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan