Executive Summary

This vulnerability, identified as CWE-22 (Path Traversal), exists in Schneider Electric's PowerChute™ Serial Shutdown product (version 1.3 and prior). It allows a Web Admin user on the local network to tamper with the POST /REST/UpdateJRE request payload, which can lead to elevated system access privileges. Essentially, it means that an attacker with low-level access on the local network can manipulate file paths to gain higher system privileges than intended. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to elevation of privileges, allowing an attacker with low-level access on the local network to gain higher system access. This impacts the confidentiality, integrity, and availability of the affected system. An attacker could potentially manipulate system files or configurations, leading to unauthorized control or disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection can focus on monitoring for tampering attempts with the POST /REST/UpdateJRE request payload by a Web Admin user on the local network. Network traffic analysis tools or web server logs can be used to identify suspicious POST requests to /REST/UpdateJRE. Specific commands depend on your environment, but examples include using curl or wget to test the endpoint, or using packet capture tools like tcpdump or Wireshark to monitor POST requests. For example, a tcpdump command to capture POST requests to the vulnerable endpoint could be: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'POST /REST/UpdateJRE'. Additionally, checking web server access logs for POST requests to /REST/UpdateJRE with unusual payloads can help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading to PowerChute™ Serial Shutdown version 1.4, which contains fixes for CVE-2025-11565. Additionally, ensure that only trusted Web Admin users on the local network have access to the system. Follow standard patching best practices such as backing up systems and testing patches in isolated environments before deployment. Implement network segmentation to isolate control and safety system networks behind firewalls, separate from business networks. Restrict programming software and administrative access to intended networks only. Also, apply physical security controls to prevent unauthorized access. For CVE-2025-11567 related to permissions, verify and set proper administrative permissions on the installation folder, especially if a custom folder is used. [1]

Useful 0 Not Useful 0