Improper encoding or escaping of output occurs when the appliance processes a POST request to the /j_security check endpoint. An attacker who supplies a crafted payload can inject arbitrary characters into the system logs, forging or misleading log entries. This subverts the integrity of audit trails and can enable malicious activity to be hidden or incident response efforts to be confused.

All Schneider Electric PowerChute Serial Shutdown devices may be affected, as the issue is tied to the web interface handling of the /j_security check endpoint. No specific sub‑versions are listed, so any firmware or software update that covers the logging issue should be applied to all deployed units.

The CVSS score of 6.9 indicates moderate severity. Exploit probability is not documented, and the vulnerability is not listed in known exploited vulnerability catalogs. The likely attack vector is network‑based: an attacker would need to manipulate the POST request over HTTP/HTTPS directed to the device’s management interface. Successful exploitation only alters log content; it does not provide direct code execution or system compromise.