Skip to content
NewA calmer, faster ZeroHour
Advisoryhigh

PowerSYSTEM Center flaws allow SQL injection and admin resource access

Original title: Subnet Solutions PowerSYSTEM Center

CISA Advisoriesby CISA ()5 min read1
Read at cisa.gov
AI summary · x-ai/grok-4.7Summaries by Vani AI

Both CVEs score 9.0; Subnet tells 2020 users to install Update 30 and later lines to install 2026 Update 1.1.

CISA advisory ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center, deployed in energy and critical manufacturing. CVE-2026-63017 lets a low-privileged authenticated user reach administrator-only resources. CVE-2026-63774 lets an authenticated user run unauthorized SQL from the report designer. Vendor fixes are 2020 Update 30 and 2026 Update 1.1; the advisory does not discuss exploitation.

Unconfirmed: The body also marks 2020 known_affected under CVE-2026-63774, while the summary lists only CVE-2026-63017 for that line; exploitation is not addressed.

Key facts
  • CVE-2026-63017 affects 2020 <=5.29.x, 2024 6.0.x–6.2.x, and 2026 7.0.x–7.1.x.
  • The summary lists CVE-2026-63774 for 2024 and 2026 builds only.
  • CVSS v3.1 is 9.0 and CVSS v4.0 is 9.4, adjacent network with low privileges.
  • Subnet is headquartered in Canada; deployments are described as worldwide.
Security assessment · AI, from the article

Impact: Authenticated users run SQL or reach admin-only resources

ProductAffectedFixed in
Subnet Solutions PowerSYSTEM Center 2020<=5.29.x2020 Update 30
Subnet Solutions PowerSYSTEM Center 2024>=6.0.x|<=6.2.x2026 Update 1.1
Subnet Solutions PowerSYSTEM Center 2026>=7.0.x|<=7.1.x2026 Update 1.1
What to do
  1. 1.Upgrade PowerSYSTEM Center 2020 to Update 30.
  2. 2.Upgrade 2024 and 2026 builds to PowerSYSTEM Center 2026 Update 1.1.
  3. 3.If unable to update, disable report designer and F12 Developer Tools access and monitor user activity.
Analyze CVE-2026-63017 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-63017CVE-2026-63774
Tags
icspowersystem-centersql-injectionincorrect-authorizationenergycritical-manufacturing
Vendors
Subnet Solutions
Products
PowerSYSTEM Center
Organizations
CISA
Countries
Canada

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-63017
+1 related CVE
CVE-2026-63774
Incorrect authorization in PowerSYSTEM Center allows low-privileged authenticated access
9.4—

From the original article

5 min read at cisa.gov

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized SQL commands and gain access to unauthorized resources. The following versions of Subnet Solutions PowerSYSTEM Center are affected: PowerSYSTEM Center 2020 =6. 0.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.