CVE-2026-2401
Sensitive Data Exposure via Logging in Web Admin Component
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: Schneider Electric SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schneider-electric | powerchute_serial_shutdown | to 1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a CWE-532 type, which involves the insertion of sensitive information into a log file. It occurs when a Web Admin user executes a malicious file provided by an attacker, potentially causing confidential information to be exposed through the logs.
How can this vulnerability impact me? :
The impact of this vulnerability is the potential exposure of confidential information due to sensitive data being written into log files. This could lead to unauthorized access to sensitive data if the logs are accessed by malicious actors.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the insertion of sensitive information into log files, which could lead to the exposure of confidential data when a Web Admin user executes a malicious file provided by an attacker.
Exposure of confidential information through logs can potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require the protection of sensitive personal and health information.
However, specific impacts on compliance or mitigation measures are not detailed in the provided information.