CVE-2023-34390: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-451
Improper input validation could lead to denial of service
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.5epss 0.7%
In short
A flaw in how the Schweitzer Engineering Laboratories SEL-451 device checks user inputs allows an authenticated attacker to crash the system or disable its services. This can interrupt critical power system operations.
Technical detail
CWE-20 input validation flaw in SEL-451 permits an authenticated remote attacker to send malformed input that triggers a denial of service condition, disabling system services or causing system unavailability. Exploitation requires prior authentication credentials.
Summary generated and translated by AI from the official description.
An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service against the system and locking out services.
See product Instruction Manual Appendix A dated 20230830 for more details.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Affected products
Schweitzer Engineering Laboratories · SEL-451Related CVEs — Schweitzer Engineering Laboratories SEL-451
In the same product, most dangerous first.
CVE-2023-31176HIGHInsufficient entropy vulnerability could lead to authentication bypassEPSS 0.9%CVE-2023-34388MEDIUMImproper authentication could lead to session hijackingEPSS 0.9%CVE-2023-34389MEDIUMAllocation of resources without limits could lead to denial of serviceEPSS 0.7%CVE-2023-31177MEDIUMImproper neutralizataion of input could lead to execution of arbitrary codeEPSS 0.5%