The PowerSYSTEM Center 2020 email notification service is vulnerable to CRLF injection (CWE-93) when using SMTPS communication. This vulnerability arises from improper neutralization of CRLF sequences, which could allow an attacker with low privileges and network access to inject carriage return and line feed characters into email headers or content. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been published by the vendor as of the data available.

An attacker with low privileges and adjacent network access could exploit this vulnerability to manipulate email notification headers or content sent by the PowerSYSTEM Center 2020. This could lead to email injection attacks such as email header manipulation or injection of malicious content into notifications. The impact on confidentiality, integrity, and availability is rated low, resulting in an overall medium severity rating. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the SMTPS service to trusted hosts and review email notification configurations to minimize exposure.