CVE-2026-13348: CWE-307 Improper restriction of excessive authentication attempts in Schneider Electric PowerChute™ Serial Shutdown

This vulnerability, classified under CWE-307, exists in Schneider Electric PowerChute™ Serial Shutdown. It involves improper restriction of excessive authentication attempts, meaning the software does not limit the number of login attempts an attacker can make when redirect handling is disabled. This could allow an attacker to brute force credentials and gain unauthorized access. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, and no required privileges or user interaction. No remediation level or patch information is currently available.

An attacker can perform an arbitrary number of authentication attempts without restriction, increasing the risk of unauthorized access to user accounts. This could compromise system integrity or confidentiality depending on the privileges of the accessed account. There is no indication of privilege escalation or impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider monitoring authentication logs for unusual activity and implementing external controls such as network-level rate limiting or multi-factor authentication if possible.