Local Privilege Escalation Vulnerability in PowerSYSTEM Center by Subnet

CVE-2023-6631

What is CVE-2023-6631?

PowerSYSTEM Center, developed by Subnet, contains a vulnerability present in versions up to and including 2020 Update 16. This vulnerability can be exploited by an authorized local user to insert arbitrary code due to the application's unquoted service path. This oversight allows attackers to escalate their privileges and execute malicious commands within the environment, posing significant risks to system integrity and security. Implementing patches and best practices to manage service paths is critical to mitigating potential exploitation.

References