A vulnerability allows the insertion of sensitive data into log files when a Web Admin user runs a malicious file. The impact is the potential disclosure of confidential information, compromising data confidentiality while using the device.

The affected product is Schneider Electric’s PowerChute® Serial Shutdown. No specific version information is supplied in the advisory.

The CVSS score of 2.4 indicates a low overall severity. The statement does not provide an EPSS score, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector requires a Web Admin or privileged user to execute a malicious file, which is a local or high privilege attack. Because the vulnerability involves sensitive data being logged, the exploitation risk is modest but remains of concern if an attacker can gain admin access.