PowerSYSTEM Center report designer SQL injection
A person logged into the report tool can secretly control the database!
Summary
Insufficient input validation in the PowerSYSTEM Center report designer lets an authenticated user run unauthorized SQL commands. Specific versions of the 2024 and 2026 product lines are affected.
Affected when
- A logged-in user account
- PowerSYSTEM Center 2024 6.0.x to 6.2.x
- PowerSYSTEM Center 2026 7.0.x to 7.1.x
What to do
Update to PowerSYSTEM Center 2026 Update 1.1 or later. The affected versions listed above are all earlier.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen