PowerSYSTEM Center vulnerabilities

The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.

The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.