EUVD-2026-29830
GHSA-9mmm-r5xw-7773
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and low privileges required per CVSS 4.0 source data; CRLF injection yields limited header/command manipulation with no meaningful availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication.
AnalysisAI
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privilege attackers to manipulate SMTP protocol sequences during SMTPS communication. All three major release lines are affected: 2020 (≤5.28.x), 2024 (6.0.x-6.1.x), and 2026 (7.0.x), as confirmed by CISA ICS-CERT advisory ICSA-26-132-02. No public exploit or active exploitation has been identified; EPSS is 0.01% and SSVC classifies exploitation as none, placing this firmly in a low-urgency remediation tier for most organizations.
Technical ContextAI
CWE-93 (Improper Neutralization of CRLF Sequences) arises when carriage return (\r) and line feed (\n) characters in user-controlled input are passed unsanitized into SMTP protocol messages or headers. In the context of SMTPS communication - the specific protocol path named in the advisory - injected CRLF sequences can be interpreted by the receiving mail server as protocol command delimiters, enabling an attacker to insert unauthorized SMTP commands or fabricate additional email headers. This class of flaw can facilitate email header spoofing, recipient manipulation, log injection, or bypass of email security controls. Affected CPEs are cpe:2.3:a:subnet_solutions:powersystem_center_2020, cpe:2.3:a:subnet_solutions:powersystem_center_2024, and cpe:2.3:a:subnet_solutions:powersystem_center_2026, all reported by ICS-CERT, indicating this is an OT/ICS product used in power utility and energy sector environments.
RemediationAI
Consult CISA ICS advisory ICSA-26-132-02 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02 and the accompanying CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-132-02.json for vendor-issued patch details from SUBNET Solutions - exact fixed version numbers are not independently confirmed in the available reference data and should be obtained directly from the vendor. As a compensating control pending patching, disable SMTPS-based email notifications in the PowerSYSTEM Center configuration if operational requirements allow, switching to an alternative alerting mechanism to eliminate the vulnerable code path; note this will suppress email-based operational alerts. If SMTPS notifications cannot be disabled, restrict network access to the PowerSYSTEM Center notification service to a minimal set of trusted internal hosts using OT network segmentation or host-based firewall rules, reducing the adjacency attack surface. Limit the number of user accounts with access to configure or trigger the email notification service.
More in Powersystem Center 2020
View allInformation disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with onl
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fai
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today