title: SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay
description:
SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity.
problem types: CWE-294 Authentication Bypass by Capture-replay
affected:
{
defaultStatus: unaffected
product: PowerSYSTEM Center
vendor: SUBNET Solutions Inc.
versions:
lessThanOrEqual: 2020 U10, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
SUBNET Solutions has fixed these issues by enabling a file integrity check on uploaded images and anti-forgery tokens to prevent replay attacks. The fix was introduced in PowerSYSTEM Center update 12 as well as Update 8+Hotfix (both identified by release number 5.12.2305.10101, which can be located in Settings / Overview / Version).
workarounds:
SUBNET Solutions recommends users to follow the following workarounds:
*  Users should verify that SVG files do not contain HTML elements or scripts and validate that JPG and PNG files are not SVG files.
*  Users should verify network security rules to ensure that outbound connections to the internet are not possible.
*  If the above cannot be performed or notifications are not required, disable email notifications for reports from PowerSYSTEM Center.
*  Monitor user activity and ensure application control rules only allow preauthorized executables to run.
*  Deny users to run other executables on client access servers (PowerSYSTEM Center front end access point).