# Critical Authorization Flaws in Subnet Solutions PowerSYSTEM Center Expose Global Critical Infrastructure
## The Threat
Subnet Solutions has disclosed multiple critical authorization vulnerabilities in PowerSYSTEM Center, a power management and monitoring platform widely deployed across energy and critical manufacturing infrastructure worldwide. The vulnerabilities allow authenticated users with limited permissions to bypass authorization controls, exposing sensitive administrative data and enabling unauthorized modifications to critical system configurations.
The affected versions span three major release lines (2020, 2024, and 2026), with some vulnerabilities present across all three generations. Successful exploitation requires an attacker to have valid authentication credentials, but the flaws allow privilege escalation from low-privilege accounts to access or modify resources normally restricted to administrators. Given that PowerSYSTEM Center manages critical infrastructure operations globally, these vulnerabilities pose significant risk to energy distribution networks and manufacturing facilities reliant on the platform.
The vulnerabilities center on improper authorization checks in REST API endpoints responsible for sensitive operations including device account export, device information access, and project group management. The flaws suggest a systemic weakness in how the application enforces role-based access controls across its API layer—a pattern that defenders should treat as a red flag for similar issues elsewhere in the codebase.
## Severity and Impact
| CVE | Product/Version | CVSS Score | CVSS Vector | Attack Complexity | CWE | Description |
|-----|-----------------|------------|-------------|-------------------|-----|-------------|
| CVE-2026-26289 | PSC 2020 5.8.x-5.28.x, PSC 2024 6.0.x-6.1.x, PSC 2026 7.0.x | 8.2 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | Low | CWE-863 | REST API device account export allows low-privilege users to expose administrative data |
| CVE-2026-33570 | PSC 2020 5.11.x-5.28.x | 5.7 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | Low | CWE-863 | REST API device access lacks proper authorization checks for operational permissions |
| CVE-2026-35555 | PSC 2024 6.0.x-6.1.x, PSC 2026 7.0.x | High | — | Low | CWE-863 | Device project group deletion allows unauthorized removal of critical configurations |
| CVE-2026-35504 | PSC 2020 ≤5.28.x, PSC 2024 6.0.x-6.1.x, PSC 2026 7.0.x | High | — | Low | CWE-863 | CRLF injection or information exposure via multiple endpoints |
All vulnerabilities require the attacker to possess valid authentication credentials (PR=L), but the network attack vector (AV:A) and low attack complexity indicate exploitation is straightforward once an account is compromised or obtained through insider access.
## Affected Products
PowerSYSTEM Center 2020:
PowerSYSTEM Center 2024:
PowerSYSTEM Center 2026:
Subnet Solutions reports that PowerSYSTEM Center is deployed worldwide across critical manufacturing and energy sectors, making this disclosure particularly urgent for organizations operating power distribution, generation, and industrial control systems.
## Mitigations
Immediate Actions:
Subnet Solutions recommends users upgrade to patched versions immediately:
For organizations unable to patch immediately, implement these compensating controls:
1. Monitor User Activity Records – Enable and regularly review audit logs to detect anomalous account exports, device access queries, or project group modifications by low-privilege users.
2. Restrict Access to Notification Settings – Limit who can modify notification configurations, particularly the "Send from Address" field, to trusted administrators only.
3. Create Alert Rules for Bulk Operations – Configure notification rules that trigger on bulk account export activity, which may indicate exploitation attempts.
4. Network Segmentation – Isolate PowerSYSTEM Center instances from untrusted networks and limit access to the REST API endpoints to only necessary systems.
5. Credential Management – Conduct a thorough audit of all PowerSYSTEM Center user accounts, rotate credentials for all low-privilege accounts, and implement multi-factor authentication where possible.
For assistance, contact Subnet Solutions System Integration or customer support at (403) 270-8885 or support@subnet.com.
## References
---
## HackWire Analysis
What stands out about this advisory is not the individual vulnerabilities—authorization flaws in management platforms are common—but the *pattern*. Three distinct CVEs, all rooted in the same root cause (CWE-863: Incorrect Authorization), spanning three major product versions. This indicates the vulnerability was not a one-off oversight in a single feature, but rather a systemic gap in how PowerSYSTEM Center validates user permissions across its API layer.
The critical insight: if authorization checks were weak enough for attackers to bypass device account export restrictions, they're likely weak elsewhere. Organizations patching only to the minimum version should assume related authorization flaws may exist in other PowerSYSTEM Center features not yet disclosed. A thorough code review of the authorization framework—not just patching the known CVEs—is warranted.
The attack surface here is worrying because it requires *valid credentials*. That's not a high bar in critical infrastructure environments where contractors, vendors, and temporary staff rotate through with access. A disgruntled employee, a compromised service account, or stolen credentials from a vendor breach could be weaponized to exfiltrate administrative data or delete critical device project groups—potentially disabling monitoring or control capabilities in power systems.
The geographic scope (worldwide deployment across energy and manufacturing) means this advisory affects infrastructure that directly or indirectly impacts millions of people. Unlike purely financial systems or cloud platforms, critical infrastructure vulnerabilities scale silently until an incident occurs. Organizations managing generation, transmission, or distribution should treat this as a priority escalation, not a standard update cycle.
The presence of a CRLF injection vulnerability (CVE-2026-35504) deserves special attention, too. CRLF injection in management platforms can lead to HTTP response splitting, cache poisoning, or credential theft through malicious notification emails—expanding the impact beyond simple information disclosure. Defenders should be alert for other injection-type flaws in this product line.
— *HackWire Editorial*
## Related Coverage