Description

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-11-06T01:17:50.297Z",
  "pubdate": "2026-11-06T01:17:50.297Z",
  "executiveSummary": "The vulnerability identified in PowerSYSTEM Center constitutes an Improper Authorization flaw, specifically categorized under CWE-285 (Improper Authorization).\nThis security defect allows an authenticated user with low-privileged access to bypass established access control lists (ACLs) and interact with administrative functions or sensitive system resources.\nThe impact includes unauthorized elevation of privilege, potential modification of critical system configurations, and exposure of sensitive operational data normally reserved for authorized administrators.\nThe vulnerability is restricted to authenticated users, meaning an attacker must possess a valid, low-privileged account within the target system to initiate the exploit.\nThe risk implication is high, as it breaks the principle of least privilege, potentially allowing a malicious actor to compromise the integrity and availability of the PowerSYSTEM Center environment.\nNo user interaction is required for the exploitation once a low-privileged session is established, making it a significant vector for lateral movement or administrative system takeover.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of the PowerSYSTEM Center authorization logic to adequately validate the security context of a request before granting access to protected resources.\nIn a secure implementation, an authorization check should occur at the object or function level, verifying that the authenticated identity possesses the requisite permissions associated with the requested administrative action.\nIn this specific instance, the application likely relies on client-side controls or insecure server-side implementation that fails to enforce boundary checks between role-based access control (RBAC) levels.\nThe exploitation process initiates when an authenticated low-privileged user constructs a direct request—typically via HTTP/HTTPS protocols—targeting an administrative endpoint or a specific resource URI/function name that lacks proper server-side authorization enforcement.\nBecause the application logic assumes the request is legitimate based solely on the session token being valid, it fails to perform a secondary lookup of the user's current effective permissions.\nThis enables the attacker to manipulate request parameters or direct object references to access administrative administrative interfaces, view sensitive system logs, or modify critical settings typically hidden from non-administrative users.\nThe attack flow follows a structured path: 1) The attacker authenticates to the PowerSYSTEM Center as a standard user. 2) The attacker intercepts or discovers the administrative API endpoints or resource paths. 3) The attacker submits crafted requests to these endpoints, bypassing UI-level obfuscations. 4) The server validates the session integrity but fails to perform role-based validation, subsequently fulfilling the request with elevated privileges.\nThe vulnerability resides within the central authorization module of the PowerSYSTEM Center. Since the enforcement is insufficient, the system effectively ignores the user's privilege profile during the execution of sensitive operations.\nPost-exploitation impact includes full administrative control over the application, unauthorized modification of system policies, extraction of sensitive configuration data, or the potential to disable security logging mechanisms, which facilitates further persistence and stealthy malicious activity within the PowerSYSTEM Center environment."
}