PowerChute Business Edition

Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-05 Page 1 of 4 ## PowerChute Business Edition 11 August 2020 ## Overview Schneider Electric is aware of a vulnerability in the PowerChute Business Edition software which may lead to remote code execution. ## Affected Product(s) PowerChute Business Edition software V9.0.x and earlier ## Vulnerability Details CVE ID: CVE-2020-7526 CVSS v3.0 Base Score 7.1 | High | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H A CWE-20: Improper Input Validation vulnerability exists which could cause remote code execution when a script is executed during a shutdown event. ## Remediation This vulnerability is fixed in version V9.1 and above. The latest versions are available for download below: https://www.apc.com/pcbe • Update to the latest release V10.x or above (64-bit environment) or V9.5 or above (32-bit environment) • Reboot if required at the end of software installation. The following workarounds and mitigations can be applied by customers to reduce the risk: • Change user login password to a secure password. • Utilize application whitelisting software. • Utilize firewall rules to limit access to those intended to connect. Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-05 Page 2 of 4 ## Product Information PowerChute Business Edition software provides UPS management, graceful shutdown and innovative energy management capabilities for servers and workstations using dedicated serial or USB connections. Product Category - Critical Power, Cooling and Racks > Learn more about Schneider Electric’s product categories here: https://www.se.com/us/en/all-products How to determine if you are affected Check the currently installed version in the Help > About menu. If V9.0.x or earlier, update to the latest version available on https://www.apc.com/pcbe . ## General Security Recommendations