CVE-2026-33570: PowerSYSTEM Center Auth Bypass Flaw

CVE-2026-33570 Overview

CVE-2026-33570 is an authorization flaw in the PowerSYSTEM Center REST API endpoint for devices. The vulnerability allows a low-privilege authenticated user to retrieve device information that should be restricted by operational permissions. The weakness is categorized as Incorrect Authorization [CWE-863]. Exploitation requires adjacent network access and valid low-privilege credentials, with no user interaction needed. CISA published guidance through ICS Advisory ICSA-26-132-02, indicating relevance to operational technology environments.

Critical Impact
Authenticated low-privilege users on the adjacent network can read device data normally gated by operational permissions, breaking the principle of least privilege in industrial control deployments.

Affected Products

PowerSYSTEM Center (REST API devices endpoint)
Specific product versions are listed in CISA ICS Advisory ICSA-26-132-02
See vendor advisory for the complete fixed-version matrix

Discovery Timeline

2026-05-12 - CVE-2026-33570 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-33570

Vulnerability Analysis

The PowerSYSTEM Center exposes a REST API endpoint that returns device information to authenticated callers. The endpoint does not correctly evaluate the operational permissions assigned to the calling user. As a result, a user holding only low-privilege credentials receives data fields that should be visible only to operators with elevated permissions. The flaw maps to CWE-863, Incorrect Authorization, meaning authentication succeeds while the downstream permission check fails to enforce the intended boundary.

The issue is confidentiality-focused. The CVSS vector indicates high confidentiality impact with no integrity or availability impact. Attack complexity is low and no user interaction is required, but the attacker must already hold an account and reach the API over an adjacent network segment.

Root Cause

The root cause is a missing or insufficient authorization check on the device REST API handler. The endpoint validates that the caller is authenticated and that an API session exists, but does not consistently verify that the caller's operational role permits reading the requested device attributes. Permission scoping that exists in the user interface layer is not mirrored in the API layer.

Attack Vector

An attacker first obtains low-privilege credentials, for example a read-only or operator-restricted account, and connects to the same logical network as the PowerSYSTEM Center server. The attacker then issues authenticated HTTP requests to the device endpoint of the REST API. The server returns device records, including fields that the user's role should not expose. No payload crafting, injection, or memory corruption is involved. See the CISA ICS Advisory ICSA-26-132-02 and the CSAF advisory file for vendor-supplied technical detail.

No verified proof-of-concept code is available. The vulnerability is described in prose because exploitation consists of standard authenticated REST calls rather than a distinct exploit artifact.

Detection Methods for CVE-2026-33570

Indicators of Compromise

Authenticated REST API requests to the PowerSYSTEM Center device endpoint originating from accounts that have no operational reason to enumerate device inventory.
Unusually high request volume from a single low-privilege account against the devices API path.
API responses returning device fields to sessions whose role mappings should exclude those fields.

Detection Strategies

Enable verbose REST API access logging on PowerSYSTEM Center and forward logs to a centralized analytics platform for role-versus-resource correlation.
Baseline normal device API consumption per user role, then alert on deviations such as low-privilege accounts pulling full device listings.
Correlate authentication events with subsequent device API calls to identify accounts that authenticate solely to query the devices endpoint.

Monitoring Recommendations

Monitor adjacent network segments that can reach the PowerSYSTEM Center management interface for new or unexpected clients.
Review service and shared accounts with low operational permissions for unexpected interactive API usage.
Track failed-to-successful authentication ratios on the API to surface credential testing that precedes information harvesting.

How to Mitigate CVE-2026-33570

Immediate Actions Required

Apply the vendor-supplied patch listed in CISA ICS Advisory ICSA-26-132-02 as soon as it is available in your maintenance window.
Restrict network reachability of the PowerSYSTEM Center REST API to a dedicated management VLAN and known administrator hosts.
Audit existing PowerSYSTEM Center accounts and remove or downgrade accounts that no longer require access.
Rotate credentials for low-privilege accounts that may have been exposed on shared or adjacent network segments.

Patch Information

Refer to the vendor advisory referenced by CISA in ICSA-26-132-02 and the corresponding CSAF JSON file for fixed versions and update procedures. Apply the patch to all PowerSYSTEM Center instances exposing the REST API.

Workarounds

Place the PowerSYSTEM Center server behind a firewall that only allows REST API traffic from explicitly authorized hosts.
Disable or constrain low-privilege accounts that are not in active operational use until patching is complete.
Require VPN or jump-host access for any administrative session that reaches the API, eliminating direct adjacent-network exposure.

bash

# Configuration example: restrict access to the PowerSYSTEM Center API host
# Replace 10.10.20.0/24 with your authorized management subnet
# and <psc-server-ip> with the PowerSYSTEM Center server address

iptables -A INPUT -p tcp -d <psc-server-ip> --dport 443 \
    -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp -d <psc-server-ip> --dport 443 -j DROP