This vulnerability in Schneider Electric PowerChute™ Serial Shutdown (versions 1.4 and prior) is classified as CWE-400, indicating uncontrolled resource consumption. Specifically, a Web Admin user can flood the system with POST /helpabout requests, triggering excessive generation of troubleshooting zip files. This resource exhaustion can degrade system performance or cause denial of service. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required beyond Web Admin, and no user interaction. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation results in excessive resource consumption on the affected system, leading to potential denial of service. This can disrupt normal operations of the PowerChute™ Serial Shutdown software, impacting availability. The vulnerability requires Web Admin privileges, limiting the scope of potential attackers to authorized users with such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Web Admin access to trusted personnel only and monitor for unusual POST /helpabout request activity to reduce risk. No official patch or temporary workaround is currently available.