This vulnerability involves improper limitation of a pathname to a restricted directory in Schneider Electric PowerChute™ Serial Shutdown (versions 1.4 and prior). Specifically, a Web Admin user can exploit the POST /REST/upssleep endpoint by altering the request payload to perform path traversal, resulting in critical files being overwritten with arbitrary text data. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no user interaction, and high privileges. The vulnerability is published and assigned CVE-2026-2399 but currently lacks an official remediation level or patch.

Successful exploitation can lead to overwriting critical files on the affected system, potentially causing denial of service or disruption of normal operations. The requirement for Web Admin privileges limits the attack surface to authorized users with elevated access. There are no known exploits in the wild, and the vulnerability does not involve remote code execution or privilege escalation beyond the Web Admin role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Web Admin access to trusted personnel only and monitor for unusual activity involving the POST /REST/upssleep endpoint. Avoid exposing the management interface to untrusted networks.