1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: Schneider Electric
- Equipment: PowerChute Serial Shutdown
- Vulnerabilities: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’), Improper Restriction of Excessive Authentication Attempts, Incorrect Default Permissions
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to access user accounts or gain elevated system access.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following version of Schneider Electric PowerChute Serial Shutdown are affected:
- Schneider Electric PowerChute Serial Shutdown: Versions 1.3 and prior
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY (‘PATH TRAVERSAL’) CWE-22
A path traversal vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST/REST/UpdateJRE request payload.
CVE-2025-11565 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.0 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
3.2.2 IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307
An improper restriction of excessive authentication attempts vulnerability exists that could allow an attacker on the local network to gain access to the user account by performing an arbitrary number
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: