CVE-2023-31160: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-2241…
Improper Neutralization of Input During Web Page Generation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The SEL RTAC web interface fails to properly filter user input, allowing an authenticated attacker to inject malicious scripts that execute in other users' browsers. This can compromise sensitive control system data or actions.
CWE-79 Stored or Reflected XSS vulnerability in SEL RTAC web interface lacks input sanitization during page generation. Attack vector requires prior authentication; attacker can inject arbitrary JavaScript to be executed in victim's session, potentially leading to unauthorized commands or data theft in the industrial control environment.
In the same product, most dangerous first.