www.cisa.gov Open in urlscan Pro
2600:141b:1c00:258d::447a  Public Scan

Form analysis
2 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

Skip to main content

An official website of the United States government

Here’s how you know

Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.

Free Cyber Services#protect2024Secure Our WorldShields UpReport A Cyber Issue



Search

×

search
 

Menu



Close
×

search
 

 * Topics
   Topics
   Cybersecurity Best Practices
   Cyber Threats and Advisories
   Critical Infrastructure Security and Resilience
   Election Security
   Emergency Communications
   Industrial Control Systems
   Information and Communications Technology Supply Chain Security
   Partnerships and Collaboration
   Physical Security
   Risk Management
   How can we help?
   GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
   TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
   LocallyFaith-Based CommunityExecutivesHigh-Risk Communities
 * Spotlight
 * Resources & Tools
   Resources & Tools
   All Resources & Tools
   Services
   Programs
   Resources
   Training
   Groups
 * News & Events
   News & Events
   News
   Events
   Cybersecurity Alerts & Advisories
   Directives
   Request a CISA Speaker
   Congressional Testimony
   CISA Conferences
   CISA Live!
 * Careers
   Careers
   Benefits & Perks
   HireVue Applicant Reasonable Accommodations Process
   Hiring
   Resume & Application Tips
   Students & Recent Graduates
   Veteran and Military Spouses
   Work @ CISA
 * About
   About
   Culture
   Divisions & Offices
   Regions
   Leadership
   Doing Business with CISA
   Site Links
   Reporting Employee and Contractor Misconduct
   CISA GitHub
   CISA Central
   2023 Year In Review
   Contact Us
   Subscribe

Free Cyber Services#protect2024Secure Our WorldShields UpReport A Cyber Issue

Breadcrumb
 1. Home
 2. News & Events
 3. Cybersecurity Advisories
 4. ICS Advisory

Share:


ICS Advisory


SUBNET SOLUTIONS INC. POWERSYSTEM CENTER

Release Date
October 03, 2024
Alert Code
ICSA-24-277-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems


View CSAF(link is external)


1. EXECUTIVE SUMMARY

 * CVSS v3 7.5
 * ATTENTION: Exploitable remotely/Low attack complexity
 * Vendor: Subnet Solutions Inc.
 * Equipment: PowerSYSTEM Center
 * Vulnerabilities: Server-Side Request Forgery (SSRF), Inefficient Regular
   Expression Complexity, Cross-Site Request Forgery (CSRF)


2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in an attacker
bypassing a proxy, creating a denial-of-service condition, or viewing sensitive
information.


3. TECHNICAL DETAILS


3.1 AFFECTED PRODUCTS

The following versions of PowerSYSTEM Center are affected:

 * PowerSYSTEM Center: PSC 2020 v5.21.x and prior


3.2 VULNERABILITY OVERVIEW

3.2.1 SERVER-SIDE REQUEST FORGERY (SSRF) CWE-918(LINK IS EXTERNAL)

Vulnerable versions of PowerSYSTEM Center utilize Axios NPM package 0.21.0,
which contains a Server-Side Request Forgery (SSRF) vulnerability where an
attacker is able to bypass a proxy by providing a URL that responds with a
redirect to a restricted host or IP address.

CVE-2020-28168(link is external) has been assigned to this vulnerability. A CVSS
v3 base score of 5.9 has been calculated; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N(link is external)).

3.2.2 INEFFICIENT REGULAR EXPRESSION COMPLEXITY CWE-1333(LINK IS EXTERNAL)

Vulnerable versions of PowerSYSTEM Center utilize Axios, which is vulnerable to
Inefficient Regular Expression Complexity.

CVE-2021-3749(link is external) has been assigned to this vulnerability. A CVSS
v3 base score of 7.5 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H(link is external)).

3.2.3 CROSS-SITE REQUEST FORGERY (CSRF) CWE-352(LINK IS EXTERNAL)

Vulnerable versions of PowerSYSTEM Center utilize Axios 1.5.1, which can
inadvertently reveal the confidential XSRF-TOKEN stored in cookies by including
it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing
attackers to view sensitive information.

CVE-2023-45857(link is external) has been assigned to this vulnerability. A CVSS
v3 base score of 6.5 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N(link is external)).


3.3 BACKGROUND

 * CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy
 * COUNTRIES/AREAS DEPLOYED: Worldwide
 * COMPANY HEADQUARTERS LOCATION: Canada


3.4 RESEARCHER

Subnet Solutions Inc. reported this vulnerability to CISA.


4. MITIGATIONS

Subnet Solutions Inc. recommends users update to PowerSYSTEM Center 2020 Update
22, which can be located in the PowerSYSTEM Center by accessing Settings >
Overview > Version. Users may also contact Subnet Solution's Customer
Service(link is external).

Subnet Solutions Inc. strongly recommends users update to the latest version. If
this is not possible, the following paragraphs describe the security control
compensation(s), mitigation(s), or workaround(s) available for identified
vulnerabilities:

 * For all vulnerabilities, users can disable usage of previous UI extensions.
 * For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection
   requests from the PowerSYSTEM Center security zone to external websites.
 * For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center
   Client Access Server user's ability to access the browser's F12 Developer
   Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN,
   and to manipulate requests to the PowerSYSTEM Center website.

CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities, such as:

 * Minimize network exposure for all control system devices and/or systems,
   ensuring they are not accessible from the internet.
 * Locate control system networks and remote devices behind firewalls and
   isolating them from business networks.
 * When remote access is required, use more secure methods, such as Virtual
   Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should
   be updated to the most current version available. Also recognize VPN is only
   as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.

Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.

CISA also recommends users take the following measures to protect themselves
from social engineering attacks:

 * Do not click web links or open attachments in unsolicited email messages.
 * Refer to Recognizing and Avoiding Email Scams for more information on
   avoiding email scams.
 * Refer to Avoiding Social Engineering and Phishing Attacks for more
   information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time.


5. UPDATE HISTORY

 * October 3, 2024: Initial Publication

This product is provided subject to this Notification and this Privacy &
Use policy.


VENDOR

 * SUBNET Solutions Inc.


TAGS

Topics
Industrial Control System Vulnerabilities, Industrial Control Systems
Sector
Critical Manufacturing Sector


PLEASE SHARE YOUR THOUGHTS

We recently updated our anonymous product survey; we’d welcome your feedback.


RELATED ADVISORIES

Oct 03, 2024
ICS Advisory | ICSA-24-277-03


DELTA ELECTRONICS DIAENERGIE

Oct 03, 2024
ICS Advisory | ICSA-24-277-01


TEM OPERA PLUS FM FAMILY TRANSMITTER

Oct 01, 2024
ICS Advisory | ICSA-24-275-01


OPTIGO NETWORKS ONS-S8 SPECTRA AGGREGATION SWITCH

Oct 01, 2024
ICS Advisory | ICSA-24-275-02


MITSUBISHI ELECTRIC MELSEC IQ-F FX5-OPC

Return to top
 * Topics
 * Spotlight
 * Resources & Tools
 * News & Events
 * Careers
 * About

Cybersecurity & Infrastructure Security Agency
 * Facebook
 * Twitter
 * LinkedIn
 * YouTube
 * Instagram
 * RSS

CISA Central 1-844-Say-CISA SayCISA@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
 * About CISA
 * Budget and Performance
 * DHS.gov
 * Equal Opportunity & Accessibility
 * FOIA Requests
 * No FEAR Act
 * Office of Inspector General
 * Privacy Policy
 * Subscribe
 * The White House
 * USA.gov
 * Website Feedback