CVE-2023-6631
📋 TL;DR
This vulnerability in PowerSYSTEM Center allows a local user with existing system access to escalate privileges by inserting malicious code into an unquoted service path. It affects versions 2020 Update 16 and earlier. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- PowerSYSTEM Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access gains full SYSTEM/administrator privileges, enabling complete system compromise, data theft, and lateral movement within the network.
Likely Case
Malicious insider or compromised user account escalates privileges to install persistent backdoors, steal credentials, or disable security controls.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and contained before significant damage occurs.
🎯 Exploit Status
Exploitation requires local access and knowledge of unquoted service path techniques. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020 Update 17 or later (check vendor advisory for exact version)
Vendor Advisory: https://subnet.com/contact/
Restart Required: Yes
Instructions:
1. Download the latest PowerSYSTEM Center update from the vendor. 2. Apply the patch following vendor instructions. 3. Restart the PowerSYSTEM Center service and verify functionality.
🔧 Temporary Workarounds
Quote Service Path
windowsManually modify the service path to include quotes around the executable path
sc config "ServiceName" binPath= ""C:\Path\To\Executable.exe"" arguments
Restrict Local Access
allLimit local user access to systems running PowerSYSTEM Center
🧯 If You Can't Patch
- Implement strict least privilege access controls to limit who has local access to affected systems
- Enable detailed auditing and monitoring of service creation/modification events and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check PowerSYSTEM Center version - if it's 2020 Update 16 or earlier, the system is vulnerable. Also check for unquoted service paths using: sc query | findstr BINARY_PATH_NAMECheck Version:
Check PowerSYSTEM Center application version through its interface or installation directoryVerify Fix Applied:
Verify PowerSYSTEM Center version is 2020 Update 17 or later. Check that service paths are properly quoted.📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4697 (Service creation)
- Unexpected service modifications
- Privilege escalation attempts
Network Indicators:
- Unusual outbound connections from PowerSYSTEM Center server
- Lateral movement attempts from the affected system
SIEM Query:
source="Windows Security" EventID=4697 | where ServiceName contains "PowerSYSTEM" OR ImagePath contains spaces without quotes