This vulnerability in Schneider Electric PowerChute™ Serial Shutdown (versions 1.4 and prior) is classified as CWE-307, indicating improper restriction of excessive authentication attempts. An attacker can make an arbitrary number of authentication requests with different credentials across multiple endpoints, potentially bypassing authentication controls and gaining unauthorized access to user accounts. The CVSS 4.0 base score is 6.9, reflecting a network attack vector with low complexity and no required privileges or user interaction. No official remediation or patch has been published by Schneider Electric as of the vulnerability disclosure date.

The vulnerability allows attackers to attempt unlimited authentication attempts without restriction, increasing the risk of unauthorized access to user accounts. This could compromise the confidentiality and integrity of the affected system. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external controls such as network-level rate limiting or access restrictions to reduce the risk of brute force attacks. Monitor for unusual authentication activity if possible.