When is APC / Schneider Electric going to post information about CVE-2021-44228?

[LarryK]

Both PowerChute Business Edition and PowerChute Network Shutdown use Java.

Are the existing versions vulnerable?

Waited for word on Friday, Saturday, and Sunday - crickets.

When is APC by Schneider Electric planning on a response?

[SeanD]

I too am looking for an official response from APC.

[LarryK]

They updated their security page earlier today, but it is clear we are going to wait quite a while until they get through everything.

https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp

https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-347-01

[BillP · Accepted solution]

@LarryK 

An announcement was post yesterday.  https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp

[BillP · Accepted solution]

For instruction on mitigating these issue with PowerChute see 

https://community.se.com/t5/APC-UPS-Data-Center-Backup/Log4-versions-used-in-Powerchute-vulnerable/m...