revengsmk/cve-2024-10511Schneider Electric PowerChute Serial Shutdown vulnerability.
Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations
PowerChute Serial Shutdown v1.2.0.301 and prior contains a mechanism to “lock out” for 2 minutes after three unsuccessful login attempts to prevent brute force password cracking. PowerChute allows only one account to be created and one login session active at a time.
An unauthenticated attacker can repeatedly perform HTTP GET request to the exposed URL that ends with /accessdenied (which increments the number of login attempts), causing constant account lock out, therefore preventing legitimate user from logging in.
PowerChute Serial Shutdown version 1.3 includes a fix for this vulnerability and is available for download here:
https://www.apc.com/us/en/product-range/137943580-powerchute-serial-shutdown/#software-and-firmware
https://www.se.com/us/en/download/document/SEVD-2024-345-01/
28-05-2024 - Vulnerability reported to the vendor.
21-11-2024 - Vendor issued a patch.
10-12-2024 - Coordinated public release of Security Notification (SEVD).
