CVE-2026-33570
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.
Risk Assessment
This could lead to disclosure of information that the user should not have access to.
Recommendation
Update PowerSYSTEM Center to a version containing the fix for this vulnerability (version not specified in the description).
Other vulnerabilities in PowerSYSTEM Center
See all- CVE-2026-35555Medium
The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
- CVE-2026-35504Medium
The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.
Original NVD description (English source)
PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS