Subnet Solutions
Monthly
Information disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with only limited permissions call the REST API device-account-export endpoint to retrieve sensitive data that should be restricted to administrators. The flaw is a broken authorization (CWE-863) check, so a low-privilege operator can escalate their effective data access without any administrative role. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with CISA's SSVC rating of 'Exploitation: none.'
Improper authorization in Subnet Solutions PowerSYSTEM Center 2024 (6.0.x-6.1.x) and 2026 (7.0.x) lets an authenticated, low-privileged user delete device project groups they should not be able to remove, causing integrity loss to the managed device inventory. The flaw stems from missing permission enforcement on the project-group deletion function rather than an authentication bypass at the perimeter. There is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none.'
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privilege attackers to manipulate SMTP protocol sequences during SMTPS communication. All three major release lines are affected: 2020 (≤5.28.x), 2024 (6.0.x-6.1.x), and 2026 (7.0.x), as confirmed by CISA ICS-CERT advisory ICSA-26-132-02. No public exploit or active exploitation has been identified; EPSS is 0.01% and SSVC classifies exploitation as none, placing this firmly in a low-urgency remediation tier for most organizations.
Information disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with only limited permissions call the REST API device-account-export endpoint to retrieve sensitive data that should be restricted to administrators. The flaw is a broken authorization (CWE-863) check, so a low-privilege operator can escalate their effective data access without any administrative role. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with CISA's SSVC rating of 'Exploitation: none.'
Improper authorization in Subnet Solutions PowerSYSTEM Center 2024 (6.0.x-6.1.x) and 2026 (7.0.x) lets an authenticated, low-privileged user delete device project groups they should not be able to remove, causing integrity loss to the managed device inventory. The flaw stems from missing permission enforcement on the project-group deletion function rather than an authentication bypass at the perimeter. There is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none.'
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
CRLF injection in SUBNET Solutions' PowerSYSTEM Center email notification service enables adjacent-network, low-privilege attackers to manipulate SMTP protocol sequences during SMTPS communication. All three major release lines are affected: 2020 (≤5.28.x), 2024 (6.0.x-6.1.x), and 2026 (7.0.x), as confirmed by CISA ICS-CERT advisory ICSA-26-132-02. No public exploit or active exploitation has been identified; EPSS is 0.01% and SSVC classifies exploitation as none, placing this firmly in a low-urgency remediation tier for most organizations.