Subnet Solutions PowerSYSTEM Center Incorrect Authorization
Affects PowerSYSTEM Center 2020 up to 5.29.x, 2024 from 6.0.x through 6.2.x, and 2026 from 7.0.x through 7.1.x. CVSS rates it critical; no vendor severity is given. Subnet Solutions recommends updating 2020 to Update 30.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in PowerSYSTEM Center 2020 Update 30
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected PowerSYSTEM Center 2020 versions up to 5.29.x Affected PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x Affected PowerSYSTEM Center 2026 versions 7.0.x through 7.1.x
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.27% · 18th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 14/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Subnet Solutions PowerSYSTEM Center has an incorrect authorization flaw that lets a low-privileged, logged-in user reach resources that should be limited to administrators. An attacker must be on the same local network segment (adjacent access) and needs a low-privilege account, with no user interaction required.
Read the original description
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity9/10CVSS 9.0
- No patch0/5No signal
What would change the score
- Would score about 64 if added to CISA KEV
- Would score about 59 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affected PowerSYSTEM Center 2020 versions up to 5.29.x Affected PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x Affected PowerSYSTEM Center 2026 versions 7.0.x through 7.1.xUpgrade to a fixed version: PowerSYSTEM Center 2020 Update 30.
Workaround: Monitor user activity records to ensure users are following acceptable usage policies, and disable PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- Subnet Solutions PowerSYSTEM Center 2020
through 5.29.x
- Subnet Solutions PowerSYSTEM Center 2024
From 6.0.x · through 6.2.x
- Subnet Solutions PowerSYSTEM Center 2026
From 7.0.x · through 7.1.x
Evidence 2
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-63017
Is CVE-2026-63017 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A low-privileged, authenticated user can access resources that are normally limited to administrators.Source: cisa.gov
Which versions are affected by CVE-2026-63017?
PowerSYSTEM Center 2020: through 5.29.x. PowerSYSTEM Center 2024: from 6.0.x through 6.2.x. PowerSYSTEM Center 2026: from 7.0.x through 7.1.x.Source: cve.now feed data
Am I affected, and how do I check?
PowerSYSTEM Center 2020 up to 5.29.x, 2024 from 6.0.x through 6.2.x, and 2026 from 7.0.x through 7.1.x. Compare the installed PowerSYSTEM Center version against these ranges.Source: cisa.gov
How do I fix CVE-2026-63017?
Subnet Solutions recommends updating PowerSYSTEM Center 2020 to Update 30. The facts list no fixed version for 2024 or 2026. Until updated, the vendor's workaround is to monitor user activity records and disable the Client Access Server users' ability to access the browser's F12 Developer Tools.Source: cisa.gov