A path traversal flaw in the /REST/upssleep API of Schneider Electric’s PowerChute Serial Shutdown allows an authenticated Web Administrator to construct a POST request that points to arbitrary file paths. The resulting write action can overwrite essential configuration files with attacker supplied data, potentially disrupting power management operations and compromising device reliability.

The vulnerability affects Schneider Electric PowerChute Serial Shutdown devices. No firmware version ranges are provided, so all current releases must be considered until an official fix is deployed.

The base severity score is 6.9, indicating moderate risk. No EPSS data is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires valid Web Administrator credentials, limiting the attack surface to systems with exposed web interfaces that grant such privileges. Once accessed, the attacker can overwrite critical files, leading to configuration loss or system downtime.