The flaw is an Improper Neutralization of CRLF Sequences that allows a Web‑Admin user to inject line‑break characters into the /setPCBEDesc request payload. In effect the injection can reset the application’s user credentials, which removes the administrator’s authenticated session. This weakness is a classic example of the CWE‑93 class and exposes users to a denial of authorized access rather than arbitrary code execution.

Schneider Electric’s PowerChute Serial Shutdown is impacted. No specific version information was disclosed in the advisory, so all deployments of this product should be treated as potentially vulnerable until an official update is released.

The CVSS score of 5.3 indicates a moderate risk. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is via the web‑based administrative interface; an attacker would need to persuade, or compromise, a user with administrative privileges to submit a crafted POST request. Because the vulnerability requires an authenticated user to trigger the payload, it is less of a public foothold but remains a serious risk for unattended admin accounts.