Schneider's PowerChute Serial Shutdown accepts unlimited login guesses when redirect handling is off

A CWE-307 flaw is a missing counter on failed logins. Schneider describes CVE-2026-13348 as allowing an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled ^[2]. With no lockout, a wrong guess costs the attacker one round trip. The attacker still needs a valid account name and a password that appears in the list being tried; on the advisory's account, the credential check itself still runs.

PowerChute Serial Shutdown is UPS management software that performs graceful system shutdown and energy management for desktops, servers and workstations ^[1]. An account on it controls when those machines go down. CISA puts the risk of leaving the flaw unremediated as improper authentication validation resulting in disruption of operations and access to system data ^[7]. The listed deployment sectors are commercial facilities, critical manufacturing, energy and information technology, worldwide, with Schneider headquartered in France ^[8].

The affected-versions line in the advisory reads "vers:intdot/<=1.5, 1.6" for CVE-2026-13348 ^[3]. The Affected Products table below it lists version 1.5 and prior ^[4]. The remediation says version 1.6 contains the fix and points to Windows and Linux downloads ^[5]. Version 1.6 therefore appears in both places in the same advisory ^[12].

Installing 1.6 restarts the PCSS service automatically, and the installed version can be checked in Control Panel or on the About page within PCSS after logging in ^[6]. The advisory conditions the flaw on redirect handling being disabled ^[2]. Reading the configuration on each install tells an operator which hosts accept unlimited attempts, and that check comes before any download.

Schneider Electric's CPCERT reported the vulnerability to CISA ^[9], and Schneider's own bulletin is SEVD-2026-223-01 ^[10]. The CISA advisory does not include a CVSS score or any report of exploitation ^[11]. Schneider's standing recommendations are about reachability: keep control and safety system networks behind firewalls and isolated from the business network, ensure control system devices are not accessible from the internet, and use VPNs where remote access is required ^[13].