title: Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element
description: PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.
problem types: CWE-428
affected:
{
defaultStatus: unaffected
product: PowerSYSTEM Center
vendor: Subnet Solutions Inc.
versions:
lessThanOrEqual: 5.16.x, status: affected, version: 2020 v5.0.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Subnet Solutions recommends users upgrade to PowerSYSTEM Center versions 2020 Update 17 or later. To obtain this software, contact Subnet Solution's  Customer Service https://subnet.com/contact/ .
workarounds:
Additionally, Subnet Solutions recommends users apply Application Allowlisting on PowerSYSTEM Center Device Communication Server (DCS) hosts to ensure only trusted executables are able to be run.
If unable to apply PowerSYSTEM Center 2020 Update 17, Subnet Solutions recommends users mitigate risk by logging in to the DCS as administrator, opening the Registry Editor, navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, locating all pscagent.* entries, and modifying the ImagePath key by enclosing it within double quotes ("). Restart computer when complete.