CVE-2026-2402
Received
Received - Intake
Improper Authentication Restriction in Multi-Endpoint Access Allows Account Takeover
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: Schneider Electric SE
Description
Description
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schneider-electric | powerchute_serial_shutdown | to 1.5 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper restriction of excessive authentication attempts, classified as CWE-307. It allows an attacker to repeatedly try different credentials across multiple endpoints without limitation, potentially gaining unauthorized access to a user account.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to user accounts by allowing attackers to perform unlimited authentication attempts. This can result in compromised accounts, data breaches, and potential misuse of user information.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70