Powersystem Center 2020
Monthly
Information disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with only limited permissions call the REST API device-account-export endpoint to retrieve sensitive data that should be restricted to administrators. The flaw is a broken authorization (CWE-863) check, so a low-privilege operator can escalate their effective data access without any administrative role. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with CISA's SSVC rating of 'Exploitation: none.'
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privilege attackers to manipulate SMTP protocol sequences during SMTPS communication. All three major release lines are affected: 2020 (≤5.28.x), 2024 (6.0.x-6.1.x), and 2026 (7.0.x), as confirmed by CISA ICS-CERT advisory ICSA-26-132-02. No public exploit or active exploitation has been identified; EPSS is 0.01% and SSVC classifies exploitation as none, placing this firmly in a low-urgency remediation tier for most organizations.
Information disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with only limited permissions call the REST API device-account-export endpoint to retrieve sensitive data that should be restricted to administrators. The flaw is a broken authorization (CWE-863) check, so a low-privilege operator can escalate their effective data access without any administrative role. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with CISA's SSVC rating of 'Exploitation: none.'
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privilege attackers to manipulate SMTP protocol sequences during SMTPS communication. All three major release lines are affected: 2020 (≤5.28.x), 2024 (6.0.x-6.1.x), and 2026 (7.0.x), as confirmed by CISA ICS-CERT advisory ICSA-26-132-02. No public exploit or active exploitation has been identified; EPSS is 0.01% and SSVC classifies exploitation as none, placing this firmly in a low-urgency remediation tier for most organizations.