By taking into account the characteristics of network-based substation automation system（SAS） and distributed system vulnerability concept of computer science， a vulnerability assessment method for SAS to cyber attack is proposed. The substation communication system is classified into six basic models to construct vulnerability state graph（VSG）. The vulnerability of single action is defined based on the exponential distribution function including parameters called vulnerability factor and equivalent attacking cost， and then the vulnerability values of target systems are calculated by four connection models of VSG. Furthermore， in consideration of the characteristics of SAS information security， a vulnerability factor quantitative method based on analytic hierarchy process（AHP）and technique of order preference by similarity to ideal solution（TOPSIS）is designed. An evaluation example， which is constructed by IEC 61850 standard， shows that the proposed method is applicable to evaluating the vulnerability of network-based SAS.