CVE-2026-13348

Schneider Electric PowerChute Serial Shutdown, the management agent used with APC UPS devices, contains an improper restriction of excessive authentication attempts (CWE-307) that allows an unauthenticated attacker to make an arbitrary number of login attempts against a user account. The weakness manifests when redirect handling is disabled, in which case the software fails to enforce account lockout or rate limiting, enabling an online password brute-force attack. An attacker who succeeds gains unauthorized access to a PowerChute account; the CVSS 4.0 vector indicates low confidentiality impact with no direct integrity or availability impact, so the primary risk is unauthorized visibility into and use of a valid account. Any organization running the affected software is potentially affected, though installations whose web interface is reachable only from trusted internal networks face materially lower risk. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.3% probability of exploitation within 30 days.

What to do: Update PowerChute Serial Shutdown to the fixed release identified in Schneider Electric's security notification as soon as it is available. Until then, restrict access to the PowerChute web interface to trusted management networks using firewall rules, verify whether redirect handling has been disabled in your configuration (the condition under which the lockout bypass occurs), use strong unique credentials for PowerChute accounts, and monitor authentication logs for repeated failed login attempts.