Powerchute Serial Shutdown CVE-2026-2400

PowerChute™ Serial Shutdown is a power management application developed by Schneider Electric. The vulnerability stems from improper neutralization of carriage return and line feed (CRLF) sequences in the /setPCBEDesc endpoint, a CWE-93 flaw commonly exploited to inject unintended control characters into protocol streams or backend processing logic. The affected product handles user credential management, and the CRLF injection allows an authenticated administrator to craft malicious payloads that manipulate the credential reset mechanism. This class of vulnerability typically bypasses input validation by embedding newline sequences that cause downstream parsers or handlers to interpret injected content as separate commands or data structures.