The vulnerability allows an attacker to perform an arbitrary number of authentication attempts with different credentials across multiple endpoints, effectively bypassing standard rate limiting. This Improper Restriction of Excessive Authentication Attempts could lead to unauthorized access to user accounts, compromising confidentiality and permitting further system exploitation.

Schneider Electric PowerChute Serial Shutdown is affected. No specific version information is provided, so any deployment of this product is potentially vulnerable until a vendor update is applied.

The CVSS score of 6.9 indicates moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation may be limited. The likely attack vector is through repeated credential submissions to the product’s authentication endpoints, and exploitation requires no special privileges or complex conditions beyond repeated access.