This vulnerability (CWE-532) in Schneider Electric PowerChute™ Serial Shutdown allows sensitive information to be written into log files under certain conditions. Specifically, when a Web Admin user executes a malicious file supplied by an attacker, confidential data may be exposed in logs. The CVSS 4.0 base score is 2.4, reflecting low impact and limited attack vector (local, low complexity, requires user interaction). The affected versions are 1.4 and earlier. No known exploits are reported in the wild, and no vendor-provided patch or remediation is currently documented.

Exposure of confidential information through log files could aid an attacker in gathering sensitive data. However, the low CVSS score and requirement for local access and user interaction limit the severity and likelihood of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit Web Admin user execution of untrusted files and monitor for suspicious activity related to log file contents. Avoid executing files from untrusted sources to reduce risk.