CVE-2023-34388mediumCWE-287

CVE-2023-34388: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-451

Improper authentication could lead to session hijacking

Published · Updated

Follow this CVE+ Monitor SEL-451

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.9%
In short

The SEL-451 device has a flaw in how it checks if users are really who they claim to be. An attacker on the network could fake being a legitimate user and take over someone else's session without needing a password.

Technical detail

CWE-287 improper authentication in SEL-451 allows remote unauthenticated attackers to hijack valid sessions and bypass authentication controls. The vulnerability enables session takeover without valid credentials, potentially granting unauthorized access to device functions and configurations.

Summary generated and translated by AI from the official description.
An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perform session hijacking attack and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Schweitzer Engineering Laboratories · SEL-451
Related CVEs — Schweitzer Engineering Laboratories SEL-451

In the same product, most dangerous first.

CVE-2023-31176HIGHInsufficient entropy vulnerability could lead to authentication bypassEPSS 0.9%CVE-2023-34390MEDIUM Improper input validation could lead to denial of serviceEPSS 0.7%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2023-31177MEDIUMImproper neutralizataion of input could lead to execution of arbitrary codeEPSS 0.5%