CVE-2023-6631

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6631
PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://subnet.com/contact/ Product
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 Third Party Advisory US Government Resource
https://subnet.com/contact/ Product
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:subnet:powersystem_center:2020:-:*:*:*:*:*:*
History

21 Nov 2024, 08:44

Type Values Removed Values Added
References () https://subnet.com/contact/ - Product () https://subnet.com/contact/ - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 - Third Party Advisory, US Government Resource () https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 - Third Party Advisory, US Government Resource

11 Jan 2024, 20:01

Type Values Removed Values Added
References () https://subnet.com/contact/ - () https://subnet.com/contact/ - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 - () https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 - Third Party Advisory, US Government Resource
First Time Subnet powersystem Center
Subnet
CPE cpe:2.3:a:subnet:powersystem_center:2020:-:*:*:*:*:*:*
Summary
  • (es) Las versiones 2020 Update 16 y anteriores de PowerSYSTEM Center contienen una vulnerabilidad que puede permitir que un usuario local autorizado inserte código arbitrario en la ruta del servicio sin comillas y escale privilegios.

08 Jan 2024, 20:15

Type Values Removed Values Added
Summary (en) Unquoted Service Path Vulnerability PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges. A CVSS v3 base score of 7.8 (High) has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). (en) PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.
References
  • () https://subnet.com/contact/ -
CWE CWE-428

08 Jan 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-08 19:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6631

Mitre link : CVE-2023-6631

CVE.ORG link : CVE-2023-6631

JSON object : View

Products Affected

subnet

  • powersystem_center
CWE
CWE-428

Unquoted Search Path or Element