CVE-2023-31150: high-severity vulnerability in Schweitzer Engineering Laboratories SEL-2241…
Storing Passwords in a Recoverable Format
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The SEL RTAC database stores passwords in a way that can be recovered and read by someone with access to the system. An attacker who gains database access can extract these passwords to compromise other accounts or systems.
CWE-257 vulnerability in SEL RTAC database: passwords are stored in a recoverable format rather than using cryptographic hashing. An authenticated attacker with database access can retrieve plaintext or easily reversible password representations, enabling lateral movement and unauthorized access to connected systems or accounts.
In the same product, most dangerous first.