EUVD-2026-29829
GHSA-g52x-wvq2-4h58
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and low privilege reflect network-segment constraint and mandatory authenticated session; confidentiality-only impact with no scope change, integrity, or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.
AnalysisAI
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
Technical ContextAI
PowerSYSTEM Center 2020 (CPE: cpe:2.3:a:subnet_solutions:powersystem_center_2020) is a SUBNET Solutions supervisory platform for power distribution management, commonly deployed in OT/ICS network segments. The vulnerability is rooted in CWE-863 (Incorrect Authorization), a class of flaws where the application correctly authenticates a user but fails to verify whether that user holds the permissions necessary for the requested resource. Specifically, the REST API endpoint for device queries does not apply the operational permission boundaries that govern access elsewhere in the application - meaning the API layer performs authentication but skips or misapplies the authorization check for device data. The CVSS 4.0 vector's AV:A metric confirms the API is adjacent-network reachable, consistent with typical OT deployments where the management plane is segregated from the internet but accessible within a plant or control network segment.
RemediationAI
Consult CISA ICS advisory ICSA-26-132-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02) for vendor-specific patch guidance - the exact fixed version is not independently confirmed from available reference data and should be obtained directly from SUBNET Solutions or the CSAF advisory document. As compensating controls pending patching, restrict access to the PowerSYSTEM Center REST API at the network layer using ACLs or firewall rules that limit adjacency-based connections to only authorized operator workstations and roles, reducing the pool of users who can reach the endpoint at all. Additionally, audit all low-privilege accounts with REST API access and revoke or tighten session permissions for accounts that do not require device query capabilities. Note that PowerSYSTEM Center is an OT/ICS platform - any patching activity should follow site-specific change management and maintenance window procedures to avoid disruption to power distribution operations.
More in Powersystem Center 2020
View allInformation disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with onl
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privileg
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today