CVE-2025-11566

MediumCVSS 6.9/10Last modified Oct 18, 2026

Description

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-307

Affected software

VendorProductVersions
Schneider ElectricPowerChute™ Serial ShutdownVersions v1.3 and prior

References

Timeline

Published
Nov 12, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-115677.3CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is nCVE-2025-115684.4A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker witCVE-2025-11576.3A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the CVE-2025-115704.6Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficieCVE-2025-115712.1Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execCVE-2025-115737.5An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a speciallCVE-2025-115757.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoCVE-2025-115764.3The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versiCVE-2025-115777.6Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot PolicCVE-2025-115787.2A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root CVE-2025-115796.5github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an CVE-2025-11586.3A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the
CVE-2025-11566: Medium severity, CVSS 6.9 | Vulnix