CVE-2026-2404
Improper Output Encoding in j_security Check Causes Log Injection
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: Schneider Electric SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schneider-electric | powerchute_serial_shutdown | to 1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an instance of CWE-116, which involves improper encoding or escaping of output. Specifically, it occurs when an attacker modifies the payload of a POST request to /j_security_check. Due to insufficient encoding or escaping, this can lead to log injection, allowing the attacker to forge or manipulate log entries.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to inject malicious content into logs. This can result in forged or misleading log entries, which may hinder incident detection, forensic analysis, and auditing processes. It could also potentially be used to hide malicious activities or confuse administrators.