CVE-2023-34392: high-severity vulnerability in Schweitzer Engineering Laboratories SEL-5037…
Missing Authentication for Critical Function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The SEL-5037 SEL Grid Configurator fails to properly verify user identity before allowing critical operations, letting attackers run unauthorized commands on managed devices if they can access the tool.
Missing authentication controls on critical functions in SEL-5037 versions before 4.5.0.20 allow unauthenticated or insufficiently authenticated attackers to execute arbitrary commands on managed devices. An authorized device operator context may be assumed, but authentication bypass enables unauthorized command execution with high impact on system integrity and availability.
In the same product, most dangerous first.