Schneider Electric PowerChute Serial Shutdown Improper Restriction of Excessive Authentication Attempts Vulnerability

A vulnerability allowing improper restriction of excessive authentication attempts has been identified in Schneider Electric's PowerChute Serial Shutdown software, versions through 1.4. This vulnerability could enable an attacker to access user accounts by conducting an unlimited number of authentication attempts with various credentials across multiple endpoints.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user accounts.

Remediation

Users can upgrade to version 1.5 of PowerChute Serial Shutdown, which addresses this vulnerability. This version is available for download from the Schneider Electric website. Specific instructions and hardening guidelines can be found in the Security Handbook.