Improper Neutralization of Input During Web Page Generation

The SEL RTAC web interface fails to properly filter user input, allowing an authenticated attacker to inject malicious scripts that execute in other users' browsers. This can compromise sensitive control system data or actions.

CWE-79 Stored or Reflected XSS vulnerability in SEL RTAC web interface lacks input sanitization during page generation. Attack vector requires prior authentication; attacker can inject arbitrary JavaScript to be executed in victim's session, potentially leading to unauthorized commands or data theft in the industrial control environment.