Schneider Electric PowerChute Serial Shutdown Uncontrolled Resource Consumption Vulnerability Leading to Denial-of-Service
Vulnerability
A vulnerability allowing uncontrolled resource consumption has been identified in Schneider Electric's PowerChute Serial Shutdown software, specifically in versions through 1.4. This vulnerability could lead to excessive creation of troubleshooting zip files and cause a denial-of-service condition. The issue arises when a Web Admin user inundates the system with POST /helpabout requests.
Impact
Exploitation of this vulnerability can cause a denial-of-service condition by overwhelming the system with excessive troubleshooting zip file creation.
Remediation
Users can upgrade to version 1.5 of PowerChute Serial Shutdown, which includes a fix for this vulnerability. Version 1.5 is available for download from the Schneider Electric website. Specific instructions and hardening guidelines can be found in the Security Handbook.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.