Vulnerability · Published Nov 12, 2025 · Assigned by schneider
CVE-2025-11566
Medium 6.9
In plain English
A medium-severity security flaw in PowerChute™ Serial Shutdown from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.4%top 60.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | PowerChute™ Serial Shutdown | Versions v1.3 and prior |
Weakness: CWE-307 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N