Medium severity4.3NVD Advisory· Published Apr 14, 2026· Updated Jun 17, 2026
CVE-2026-2400
CVE-2026-2400
Description
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Admin user alters the POST /setPCBEDesc request payload.
Affected products
2- cpe:2.3:a:schneider-electric:powerchute_serial_shutdown:*:*:*:*:*:*:*:*Range: <1.5
Patches
Vulnerability mechanics
References
1- download.schneider-electric.com/filesnvdVendor Advisory
News mentions
1- Schneider Electric PowerChute Serial ShutdownCISA ICS Advisories