CVE-2023-6631

Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element

Description

PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.

Remediation

Solution:

  • Subnet Solutions recommends users upgrade to PowerSYSTEM Center versions 2020 Update 17 or later. To obtain this software, contact Subnet Solution's Customer Service https://subnet.com/contact/ .

Workaround:

  • Additionally, Subnet Solutions recommends users apply Application Allowlisting on PowerSYSTEM Center Device Communication Server (DCS) hosts to ensure only trusted executables are able to be run. If unable to apply PowerSYSTEM Center 2020 Update 17, Subnet Solutions recommends users mitigate risk by logging in to the DCS as administrator, opening the Registry Editor, navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, locating all pscagent.* entries, and modifying the ImagePath key by enclosing it within double quotes ("). Restart computer when complete.

Category

7.8
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.06%
Third-Party Advisory cisa.gov
Affected: Subnet Solutions Inc. PowerSYSTEM Center
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 third party advisory us government resource
https://subnet.com/contact/ product

Frequently Asked Questions

What is the severity of CVE-2023-6631?
CVE-2023-6631 has been scored as a high severity vulnerability.
How to fix CVE-2023-6631?
To fix CVE-2023-6631: Subnet Solutions recommends users upgrade to PowerSYSTEM Center versions 2020 Update 17 or later. To obtain this software, contact Subnet Solution's Customer Service https://subnet.com/contact/ .
Is CVE-2023-6631 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-6631 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-6631?
CVE-2023-6631 affects Subnet Solutions Inc. PowerSYSTEM Center.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.