CVE-2025-31354: PowerSYSTEM Center SMTPS DOS Vulnerability

CVE-2025-31354 Overview

CVE-2025-31354 affects the Simple Mail Transfer Protocol Secure (SMTPS) notification service in Subnet Solutions PowerSYSTEM Center. An attacker on an adjacent network can import an Elliptic Curve (EC) certificate containing crafted F2m curve parameters. The service then consumes excessive CPU cycles while evaluating the curve, degrading availability of the notification component. The issue is tracked under [CWE-125] (Out-of-Bounds Read) and disclosed through CISA ICS Advisory ICSA-25-100-08.

Critical Impact

Adjacent-network attackers can trigger sustained CPU exhaustion in the PowerSYSTEM Center SMTPS notification service, disrupting operational technology (OT) alerting workflows.

Affected Products

• Subnet Solutions PowerSYSTEM Center (SMTPS notification service)
• Deployments relying on EC certificate handling within PowerSYSTEM Center
• Industrial control system (ICS) environments using PowerSYSTEM Center for notifications

Discovery Timeline

• 2025-04-11 - CVE-2025-31354 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31354

Vulnerability Analysis

The PowerSYSTEM Center SMTPS notification service parses EC certificates supplied during trust or configuration operations. When the certificate specifies characteristic-two field (F2m) curve parameters, the service evaluates those parameters before establishing the secure channel. Crafted values force the parser into an expensive validation path, resulting in prolonged CPU consumption.

The root weakness is classified as [CWE-125] Out-of-Bounds Read during curve parameter processing. This class of flaw in cryptographic parsers commonly leads to denial-of-service conditions rather than memory disclosure when values are constrained to trigger arithmetic loops.

Root Cause

The SMTPS service does not sufficiently validate F2m field parameters (m, reduction polynomial coefficients, and related values) before consuming them. Malformed inputs cause the underlying EC math routines to iterate over out-of-range data, producing algorithmic complexity behavior consistent with a resource exhaustion condition.

Attack Vector

Exploitation requires adjacent-network access to the SMTPS endpoint and the ability to submit or negotiate an EC certificate. No authentication or user interaction is required. Successful exploitation impacts availability of the notification service; confidentiality and integrity are not affected.

No verified proof-of-concept code is publicly available. Refer to the CISA ICS Advisory ICSA-25-100-08 for authoritative technical details.

Detection Methods for CVE-2025-31354

Indicators of Compromise

• Sustained high CPU utilization by the PowerSYSTEM Center SMTPS notification process without corresponding legitimate mail volume
• Unexpected inbound TLS handshakes to the SMTPS listener from adjacent hosts presenting EC certificates with F2m parameters
• Notification delivery latency, timeouts, or queue backlog in PowerSYSTEM Center logs

Detection Strategies

• Baseline normal CPU consumption of the SMTPS service and alert on sustained deviations that persist beyond a single handshake
• Inspect TLS handshake telemetry for client certificates advertising characteristic-two (F2m) elliptic curves, which are uncommon in modern deployments
• Correlate notification service errors with connection attempts from unauthorized hosts on the OT segment

Monitoring Recommendations

• Forward PowerSYSTEM Center service and Windows performance logs to a centralized analytics platform for behavioral correlation
• Enable network flow monitoring on ICS segments to identify anomalous TLS sessions targeting the SMTPS port
• Track process-level resource utilization on hosts running PowerSYSTEM Center and alert on thresholds indicative of exhaustion

How to Mitigate CVE-2025-31354

Immediate Actions Required

• Review the CISA ICS Advisory ICSA-25-100-08 and apply vendor-supplied updates for PowerSYSTEM Center as soon as available
• Restrict network reachability of the SMTPS notification service to trusted management hosts using firewall rules or VLAN segmentation
• Audit currently trusted certificates and remove any unexpected EC certificates from the PowerSYSTEM Center trust store

Patch Information

Refer to Subnet Solutions and the CISA advisory for the fixed release of PowerSYSTEM Center. Apply the vendor-provided patch that hardens EC certificate parsing against malformed F2m parameters. No patch identifiers were included in the NVD record at time of publication.

Workarounds

• Disable the SMTPS notification service if it is not required for operations
• Enforce strict allow-lists for hosts permitted to establish TLS sessions with the notification service
• Where feasible, configure the environment to accept only prime-field (Fp) elliptic curves such as secp256r1 or secp384r1, avoiding characteristic-two curves