PowerChute Network Shutdown VMware Virtual Appliance Apache Log4j

[JQuigley]

Hello,

Looks like the latest version of PowerChute Network Shutdown is using Apache Log4j 2.24.3.  Currently its being flagged as a vulnerability on the network if its less than 2.25 since 2.24.3 is no longer maintained.  Is this able to be updated manually or are there plans to update to 2.25?

[BillP]

@JQuigley 

Although a vulnerability scanner flags CVE-2025-68161 in PowerChute Network Shutdown (PCNS) 5.2, due to Log4j-core 2.24.3, PCNS does not use the affected feature, “Socket Appender”. The feature appears in the PowerChute installation only because it is part of the default Log4j‑core package; it is neither enabled nor used by the application.

NOTE: An upcoming version of PCNS will have updated Log4j files.

If you need to urgently mitigate the issue, you can download the latest log4j release from https://logging.apache.org/log4j/2.x/download.html (apache-log4j-2.25.3-bin.zip).

Next, uncompress the apache-log4j-2.25.3-bin.zip.file.

Next, stop the PCNS service (see Schneider Electric FAQ https://www.se.com/us/en/faqs/FA290624/ for assistance with stopping and starting the PowerChute service).

Next, move the following files found in \APC\PowerChute\group1\lib

log4j-api-2.24.3.jar

log4j-core-2.24.3.jar

log4j-slf4j2-impl-2.24.3.jar

to a new folder/directory and replace them with the updated log4j file you just downloaded.

log4j-api-2.25.3.jar

log4j-core-2.25.3.jar

log4j-slf4j2-impl-2.25.3.jar

Once the new files are in place, restart the PCNS service.