CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-24-100-01: SUBNET PowerSYSTEM Server and Substation Server ↗ source

April 9, 2024 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-100-01

Summary

Successful exploitation of the vulnerabilities in components used by PowerSYSTEM Server 2021 and Substation Server 2021 could allow privilege escalation, denial of service, or arbitrary code execution. CVE-2024-3313: SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-24-100-01
Status
Final · version 1
Initial release
2024-04-09
Last revised
2024-04-09
Vendor
Subnet Solutions Inc.
Critical infrastructure sectors
Critical Manufacturing, Energy
Deployed
Worldwide
Vendor headquarters
Canada

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

Credit: SUBNET Solutions

Affected products (2)
  • PowerSYSTEM Server — <=4.07.00
  • Substation Server 2021 — <=4.07.00

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2024-3313 CWE-1357 Reliance on Insufficiently Trustworthy Component 8.4 High SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021.

Vendor fix: Subnet Solutions has fixed these issues by identifying and replacing out of date libraries used in previous versions of PowerSYSTEM Server and Substation Server 2021. Users are advised to update to version 4.09.00.927 or newer. To obtain this software, contac… ↗

Affected, fixed & timeline

Affected:

  • PowerSYSTEM Server <=4.07.00
  • Substation Server 2021 <=4.07.00

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-3313 8.4 High SUBNET Solutions PowerSYSTEM Server SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021.

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.