Schneider Electric PowerChute Serial Shutdown
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations. Failure to apply the remediation provided below may risk improper input validation which could result in disruption of operations and access to system data.
beschreibt (7)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-2405US | medium6.5 | — | ||
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the s… | ||||
| CVE-2026-2404US | medium5.3 | — | ||
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security check request payloa… | ||||
| CVE-2026-2403US | medium4.3 | — | ||
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters… | ||||
| CVE-2026-2402US | medium5.3 | — | ||
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary nu… | ||||
| CVE-2026-2401US | medium5.0 | — | ||
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious fi… | ||||
| CVE-2026-2400US | medium4.3 | — | ||
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Admin user alters the P… | ||||
| CVE-2026-2399US | medium6.1 | — | ||
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with text data when a Web Adm… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Multiple Vulnerabilities on PowerChute™ Serial Shutdown - SEVD-2026-104-01 PDF Versionself
- Multiple Vulnerabilities on PowerChute™ Serial Shutdown - SEVD-2026-104-01 CSAF Versionself
- ICS Advisory ICSA-26-190-02 JSONself
- ICS Advisory ICSA-26-190-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (7)
- BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - BehobenPowerChute™ Serial Shutdown
Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan