ICSA-26-190-02: Detecting and Mitigating Schneider Electric PowerChute Vulnerabilities

---
title: Potential Path Traversal Attempt Against Web Management Interface
id: 8a2c1d5e-4f3a-4b7a-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects potential path traversal activity in web logs targeting management interfaces like PowerChute. Attackers use sequences like '../' to escape the web root.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: web_access
  product: proxy
detection:
  selection:
    cs-uri-query|contains:
      - '../'
      - '%2e%2e%2f'
      - '..\'
      - '%2e%2e%5c'
  condition: selection
falsepositives:
  - Misconfigured legacy web applications
  - Unusual but authorized API testing
level: medium
---
title: Potential CRLF Injection (Log Forgery) in Web Requests
id: 9b3d2e6f-5g4b-5c8b-0d2e-3f4g5a6b7c8e
status: experimental
description: Detects CRLF injection attempts often used to forge logs or split HTTP responses. Looks for URL encoded carriage return/line feeds.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1564.008
logsource:
  category: web_access
  product: proxy
detection:
  selection:
    cs-uri-query|contains:
      - '%0d%0a'
      - '%0D%0A'
  condition: selection
falsepositives:
  - Legitimate data transmission containing encoded line breaks (rare in query strings)
level: high
---
title: Brute Force Authentication Attempt against OT Management Portal
id: 0c4e3f7g-6h5c-6d9c-1e3f-4g5h6a7b8c9d
status: experimental
description: Detects multiple failed login attempts originating from a single source IP against a specific management interface, indicating a potential brute force attack.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1110.003
logsource:
  category: authentication
  product: ot
detection:
  selection:
    EventID: 4625 # Failed Login
  filter:
    TargetUserName|contains: 'admin'
  timeframe: 5m
  condition: selection | count() by SourceIpAddress > 10
falsepositives:
  - Misconfigured service accounts
  - Legacy devices failing authentication loops
level: high

// Hunt for Path Traversal patterns in Syslog/CEF or CommonSecurityLog
// Adjust 'cs-uri-query' based on your specific schema normalization
CommonSecurityLog
| where TimeGenerated > ago(1d)
| where RequestMethod in ("POST", "GET")
| where cs-uri-query has "../" 
   or cs-uri-query has "%2e%2e" 
   or cs-uri-query has "..\"
| project TimeGenerated, DeviceIP, SourceIP, DestinationIP, RequestMethod, cs-uri-query, DeviceAction
| summarize count() by SourceIP, DeviceIP, bin(TimeGenerated, 1h)
| order by count_ desc

-- Hunt for installation of PowerChute Serial Shutdown on Linux/Windows endpoints
-- and check for suspicious process execution patterns (e.g., web server spawning shell)

SELECT OSPath, Mtime, Atime, Size
FROM glob(globs="/*PowerChute*", root="/")
WHERE OSPath

-- Alternative: Check for process names often associated with this software
-- Note: Replace process names if specific binary names are confirmed during IR
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Name =~ "powerchute" 
   OR Name =~ "pcss" 
   OR Exe =~ "PowerChute"

#!/bin/bash
# PowerChute Serial Shutdown Vulnerability Remediation Check (Linux)
# Checks for running processes and advises on version upgrade.

PROCESS_NAMES=("pcss" "PowerChute" "jre") # Add specific binary names if known
VULN_VERSION="1.4"

echo "[+] Scanning for Schneider Electric PowerChute Serial Shutdown processes..."
FOUND=0

for PROC in "${PROCESS_NAMES[@]}"; do
  if pgrep -x "$PROC" > /dev/null; then
    echo "[!] Potential PowerChute process found: $PROC"
    pgrep -a "$PROC"
    FOUND=1
  fi
done

if [ "$FOUND" -eq 1 ]; then
  echo "[!] Action Required: Verify the software version."
  echo "[!] If PowerChute Serial Shutdown is installed, ensure it is upgraded to a version newer than $VULN_VERSION."
  echo "[!] Refer to Schneider Electric advisory for download links."
else
  echo "[-] No default PowerChute processes detected."
fi

# PowerChute Serial Shutdown Vulnerability Remediation Check (Windows)
# Checks registry for installed PowerChute Serial Shutdown versions.

$RegPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$TargetProduct = "*PowerChute*Serial*"
$VulnerableVersions = "1.4", "1.3", "1.2", "1.1", "1.0"

Write-Host "[+] Scanning for Schneider Electric PowerChute Serial Shutdown..." -ForegroundColor Cyan

$InstalledApps = Get-ItemProperty $RegPaths -ErrorAction SilentlyContinue | 
    Where-Object { $_.DisplayName -like $TargetProduct }

if ($InstalledApps) {
    foreach ($App in $InstalledApps) {
        Write-Host "[!] Found Installation:" -ForegroundColor Yellow
        Write-Host "    Name: $($App.DisplayName)"
        Write-Host "    Version: $($App.DisplayVersion)"
        
        # Note: Perform strict version comparison if specific version strings are confirmed
        if ($VulnerableVersions -contains $App.DisplayVersion) {
            Write-Host "[!] STATUS: VULNERABLE. Version is 1.4 or lower." -ForegroundColor Red
            Write-Host "[!] ACTION: Update to the latest version immediately via Schneider Electric Support."
        } else {
            Write-Host "[-] STATUS: Version appears higher than 1.4, but please verify against the vendor advisory." -ForegroundColor Green
        }
    }
} else {
    Write-Host "[-] No PowerChute Serial Shutdown installations found in Registry." -ForegroundColor Green
}