Description
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.
Scores
CVSS v4
6.9
EPSS
0.0007
EPSS Percentile
21.7%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-307
Status
published
Products (1)
Schneider Electric/PowerChute™ Serial Shutdown
Versions v1.3 and prior
Published
Nov 12, 2025
Tracked Since
Feb 18, 2026