This vulnerability (CWE-93) in Schneider Electric PowerChute™ Serial Shutdown allows a Web Admin user to inject CRLF sequences via the POST /setPCBEDesc request payload. This improper input neutralization can lead to unintended resetting of application user credentials. The issue affects versions 1.4 and earlier. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. No official fix or patch has been documented by Schneider Electric as of the published date.

Successful exploitation results in the resetting of application user credentials, which could disrupt administrative access and potentially require reconfiguration or recovery actions. There is no indication of privilege escalation, data disclosure, or remote code execution from the provided data. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Web Admin access to trusted personnel only and monitor for unusual POST /setPCBEDesc requests. Avoid altering this request payload unless necessary. Follow Schneider Electric’s official communications for updates on patches or mitigations.