PT-2024-15033 · Unknown · Powersystem Center

Kelly Stich · Published 2024-01-08 · Updated 2024-01-11 · CVE-2023-6631

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerSYSTEM Center versions 2020 Update 16 and prior

Description The issue allows an authorized local user to insert arbitrary code into the unquoted service path, potentially leading to privilege escalation.

Recommendations For PowerSYSTEM Center versions 2020 Update 16 and prior, update to a version later than 2020 Update 16 to resolve the issue. At the moment, there is no information about additional mitigation measures.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2023-6631

Affected Products

Powersystem Center

References · 6

• https://osv.dev/vulnerability/CVE-2023-6631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6631 · Security Note
• https://subnet.com/contact · Note
• https://t.me/cvenotify/66671 · Telegram Post
• https://twitter.com/CVEnew/status/1744453192434524234 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-353-01 · Note