PowerChute™ Serial Shutdown
Plan Patch7.8SEVD-2025-315-01Nov 11, 2025
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
PowerChute™ Serial Shutdown versions 1.3 and earlier contain multiple vulnerabilities (path traversal, weak credential validation, and insecure file permissions) that allow local attackers to escalate privileges or bypass authentication. This UPS management software is used to enable graceful system shutdown and energy management capabilities for desktop systems, servers, and workstations. Exploitation could result in disruption of UPS operations, unauthorized system shutdown, and access to sensitive system data.
What this means
What could happen
An attacker with local access to a system running PowerChute Serial Shutdown could gain elevated privileges or access the system without authentication, potentially disrupting UPS management, graceful shutdowns, and energy management across servers and workstations.
Who's at risk
Energy sector organizations operating UPS management and graceful shutdown systems should care, particularly those using PowerChute Serial Shutdown on desktop systems, servers, and workstations to manage power distribution and system availability during outages.
How it could be exploited
An attacker with local access to a system running PowerChute Serial Shutdown v1.3 or earlier can exploit path traversal (CWE-22), weak credential validation (CWE-307), or insecure file permissions (CWE-276) to escalate privileges or bypass authentication, gaining control over the UPS management functions and system shutdown processes.
Prerequisites
- Local access to the system running PowerChute Serial Shutdown
- Unprivileged or limited user account
- PowerChute Serial Shutdown version 1.3 or earlier installed
Locally exploitableLow attack complexityRequires local user accessAffects availability and confidentiality of systems
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
PowerChute™ Serial Shutdown≤ 1.3v1.4
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict local access to systems running PowerChute Serial Shutdown to authorized administrators only
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpdate PowerChute Serial Shutdown to version 1.4 or later on all Windows systems
HOTFIXUpdate PowerChute Serial Shutdown to version 1.4 or later on all Linux systems
Long-term hardening
0/1HARDENINGApply principle of least privilege to user accounts that interact with PowerChute Serial Shutdown
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/8536fef0-3264-47fd-9041-69197a8de00d