Excessive CPU Consumption in Subnet Solutions PowerSYSTEM Center SMTPS Notification Service
CVE-2025-31354

5.3MEDIUM

Key Information:

Vendor

Subnet Solutions

Status
Powersystem Center 2020
Vendor
CVE Published:
11 April 2025

What is CVE-2025-31354?

The SMTPS notification service of Subnet Solutions PowerSYSTEM Center is vulnerable to a Denial of Service attack when an EC certificate with specially crafted F2m parameters is imported. This vulnerability can result in excessive CPU consumption during the evaluation of the curve parameters, potentially disrupting normal operations and performance of the affected service.

Affected Version(s)

PowerSYSTEM Center 2020 0 <= 5.24.x

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Subnet Solutions Inc. reported this vulnerability to CISA.
.