ICS Advisory: Subnet Solutions Inc. PowerSYSTEM Center

Summary:

A vulnerability has been identified in PowerSYSTEM Center, a multi-function management platform, affecting versions 2020 v5.0.x through 5.16.x. The vulnerability, rated CVSS v3 7.8, allows an authorized local user to insert arbitrary code into the unquoted service path, enabling privilege escalation and arbitrary code execution. Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2020 Update 17 or later, or apply mitigations such as modifying the ImagePath registry key. CISA advises minimizing network exposure, using secure remote access methods, and implementing recommended cybersecurity strategies to minimize the risk of exploitation.