Summary
Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized SQL commands and gain access to unauthorized resources.
The following versions of Subnet Solutions PowerSYSTEM Center are affected:
- PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017)
- PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x (CVE-2026-63017, CVE-2026-63774)
- PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x (CVE-2026-63017, CVE-2026-63774)
CVSS
Vendor
Equipment
v3 9
Subnet Solutions
PowerSYSTEM Center
2 Vulnerabilities
Incorrect Authorization, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Background
- Critical Infrastructure Sectors: Critical Manufacturing, Energy
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: Canada
Vulnerabilities
Expand All +
CVE-2026-63017
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
Read More
3 Affected Products
Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x
Product Status: known_affected
Remediations
Mitigation
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
Subnet Solutions PowerSYSTEM Center 2020 <=5.29.x
Product Status: known_affected
Remediations
Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2020 Update 30. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x
Product Status: known_affected
Remediations
Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
Additional Metrics
Relevant CWE: CWE-863 Incorrect Authorization
CVSS Version
Base Score
Base Severity
Vector String
3.1
9
CRITICAL
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0
9.4
CRITICAL
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2026-63774
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
Read More
5 Affected Products
Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x
Product Status: known_affected
Remediations
Mitigation
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.
Subnet Solutions PowerSYSTEM Center 2020 <=5.29.x
Product Status: known_affected
Remediations
Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x
Product Status: known_affected
Remediations
Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.
Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x
Product Status: known_affected
Remediations
Mitigation
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: