CISA flags two flaws in Subnet Solutions PowerSYSTEM Center software
CISA has published an advisory on two vulnerabilities in Subnet Solutions' PowerSYSTEM Center that could let an attacker run unauthorized database commands. Operators of the product should check which version they run.
Written by the SecurityTabs AI newsroom from the original post by CISA Advisories; vulnerability scores come from NVD, FIRST and CISA, not the AI.
CISA published an advisory on Subnet Solutions PowerSYSTEM Center covering two vulnerabilities, tracked as CVE-2026-63017 and CVE-2026-63774. The advisory describes them as incorrect authorization and improper handling of special elements, a weakness type tied to SQL injection. [1]
CISA says successful exploitation could let an attacker execute unauthorized SQL commands, meaning instructions sent to the product's database, and gain access to resources they should not have. The advisory lists a vendor equipment CVSS v3 score of 9. [1]
Affected versions are PowerSYSTEM Center 2020 up to 5.29.x for CVE-2026-63017, and PowerSYSTEM Center 2024 (6.0.x to 6.2.x) and PowerSYSTEM Center 2026 (7.0.x to 7.1.x) for both CVE-2026-63017 and CVE-2026-63774. No exploitation is mentioned in the advisory, and no CVSS, EPSS or CISA KEV data is available for either CVE. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- WeaknessSQL injectionSlipping database commands into input an application passes to its database.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptEPSS · Exploit Prediction Scoring SystemA daily estimate of how likely a vulnerability is to be exploited in the next 30 days.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
Original sources
- [1]CISA Advisories
Subnet Solutions PowerSYSTEM Center