CVE-2023-31177mediumCWE-79

CVE-2023-31177: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-451

Improper neutralizataion of input could lead to execution of arbitrary code

Published · Updated

Follow this CVE+ Monitor SEL-451

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.5%
In short

The SEL-451 device does not properly filter user input in web pages, allowing attackers to create malicious links that execute harmful code on a victim's computer when clicked.

Technical detail

Cross-site scripting (XSS) vulnerability in SEL-451 web interface fails to neutralize untrusted input during HTML generation. An attacker can craft a malicious link containing JavaScript payload that executes in the victim's browser with the privileges of the authenticated session, potentially compromising device configuration or sensitive data.

Summary generated and translated by AI from the official description.
An Improper Neutralization of Input During Web Page Generation  ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system. See product Instruction Manual Appendix A dated 20230830 for more details.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected products
Schweitzer Engineering Laboratories · SEL-451
Related CVEs — Schweitzer Engineering Laboratories SEL-451

In the same product, most dangerous first.

CVE-2023-31176HIGHInsufficient entropy vulnerability could lead to authentication bypassEPSS 0.9%CVE-2023-34388MEDIUMImproper authentication could lead to session hijackingEPSS 0.9%CVE-2023-34390MEDIUM Improper input validation could lead to denial of serviceEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%