CVE-2023-31161mediumCWE-20

CVE-2023-31161: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-3350

Improper Input Validation in Web Interface

Published · Updated

Follow this CVE+ Monitor SEL-3350+ Monitor SEL-3532

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.5%
In short

The Schweitzer Engineering Laboratories RTAC Web Interface does not properly validate user input, allowing an authenticated attacker to misuse internal resources in unintended ways. This could lead to various harmful effects depending on what resources are accessed.

Technical detail

An improper input validation flaw in the SEL RTAC Web Interface (CWE-20) permits authenticated remote attackers to manipulate internal resources through crafted requests. The vulnerability requires prior authentication and allows potential resource abuse with impacts dependent on affected system functionality.

Summary generated and translated by AI from the official description.
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an authenticated remote attacker to use internal resources, allowing a variety of potential effects. See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected products
Schweitzer Engineering Laboratories · SEL-3350Schweitzer Engineering Laboratories · SEL-3532Schweitzer Engineering Laboratories · SEL-3555Schweitzer Engineering Laboratories · SEL-3560ESchweitzer Engineering Laboratories · SEL-3560S
Related CVEs — Schweitzer Engineering Laboratories SEL-3350

In the same product, most dangerous first.

CVE-2023-31149CRITICALImproper Input Validation in Web InterfaceEPSS 1.1%CVE-2023-31148CRITICALImproper Input Validation in Web InterfaceEPSS 1.1%CVE-2023-31166MEDIUMImproper Limitation of a Pathname to a Restricted DirectoryEPSS 0.6%CVE-2023-31162MEDIUMImproper Input Validation in Web InterfaceEPSS 0.5%CVE-2023-31150HIGHStoring Passwords in a Recoverable FormatEPSS 0.5%CVE-2023-31165MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%