Kelly Stich

**Name of the Vulnerable Software and Affected Versions** PowerSYSTEM Center (affected versions not specified) **Description** The email notification service is subject to a CRLF injection, which occurs when a system fails to properly sanitize carriage return (CR) and line feed (LF) characters, allowing an attacker to inject malicious headers or content into the email stream during SMTPS communication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerSYSTEM Center (affected versions not specified) **Description** A REST API endpoint used for device account export allows an authenticated user with limited permissions to expose sensitive information that is normally restricted to administrative permissions only. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerSYSTEM Center (affected versions not specified) **Description** A REST API endpoint for devices allows an authenticated user with low privileges to access information that is typically restricted by operational permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerSYSTEM Center (affected versions not specified) **Description** The device project groups feature allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerSYSTEM Center versions 2020 Update 16 and prior **Description** The issue allows an authorized local user to insert arbitrary code into the unquoted service path, potentially leading to privilege escalation. **Recommendations** For PowerSYSTEM Center versions 2020 Update 16 and prior, update to a version later than 2020 Update 16 to resolve the issue. At the moment, there is no information about additional mitigation measures.