OTPulse

Schneider Electric PowerChute Serial Shutdown

MonitorCVSS 5.3ICS-CERT ICSA-26-260-07Aug 11, 2026
Schneider ElectricEnergy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Schneider Electric PowerChute Serial Shutdown contains vulnerabilities in improper authentication validation (CWE-307). The software is used for UPS management, graceful system shutdown, and energy management on desktops, servers, and workstations. Exploitation could bypass authentication controls, leading to unauthorized access and disruption of operations.

What this means
What could happen
An attacker with network access could bypass authentication on PowerChute Serial Shutdown and gain unauthorized control over UPS management functions, potentially forcing unplanned system shutdowns or preventing graceful shutdown during emergencies.
Who's at risk
Energy sector organizations using PowerChute Serial Shutdown for UPS management on desktop, server, or workstation systems. This includes utility companies and industrial facilities that rely on graceful system shutdown and power management for critical infrastructure.
How it could be exploited
An attacker on the network sends requests to PowerChute Serial Shutdown without valid credentials. Improper authentication validation allows the attacker to bypass access controls and execute UPS management commands or read system data without logging in.
Prerequisites
  • Network access to PowerChute Serial Shutdown service
  • PowerChute Serial Shutdown running on affected version (v1.5 or earlier)
remotely exploitableno authentication requiredlow complexityaffects availability (UPS shutdown capability)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
PowerChute™ Serial Shutdown≤ 1.5Fix available
Remediation & Mitigation

Version v1.6 of PowerChute™ Serial Shutdown includes a fix for these vulnerabilities and is available for download here: • Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/ Reboot needed: Upon installation, the service is automatically restarted. A customer can validate a successful install by checking the version information in the Control Panel or on the About page within PCSS after logging in. Specific instructions and hardening guidelines for these remediations can be found in the [Security Handbook](https://download.se.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN). Version v1.6 of PowerChute™ Serial Shutdown includes a fix for these vulnerabilities and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Reboot needed: Upon installation, the service is automatically restarted. A customer can validate a successful install by checking the version information in the Control Panel or on the About page within PCSS after logging in. Specific instructions and hardening guidelines for these remediations can be found in the [Security Handbook](https://download.se.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).

View full CISA ICS-CERT advisory
API: /api/v1/advisories/de25b83a-248a-452a-9776-67bc3e25db25

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Schneider Electric PowerChute Serial Shutdown | CVSS 5.3 - OTPulse