Skip to main content

Sel 2241 Rtac Module Firmware CVE-2023-31152

HIGH
Authentication Bypass Using an Alternate Path or Channel (CWE-288)
2023-05-10 security@selinc.com
Authentication Bypass Sel 2241 Rtac Module Firmware Sel 3350 Firmware Sel 3505 Firmware Sel 3505 3 Firmware Sel 3530 Firmware Sel 3530 4 Firmware Sel 3532 Firmware Sel 3555 Firmware Sel 3560E Firmware Sel 3560S Firmware
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 10, 2023 - 20:15 nvd
HIGH 8.8

DescriptionNVD

An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more details.

AnalysisAI

An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-288. An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more details. Affected products include: Selinc Sel-2241 Rtac Module Firmware, Selinc Sel-3350 Firmware, Selinc Sel-3505 Firmware, Selinc Sel-3505-3 Firmware, Selinc Sel-3530 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Sel 2241 Rtac Module Firmware

View all
CVE-2023-31149 HIGH
8.8 May 10

An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (S
CVE-2023-31148 HIGH
8.8 May 10

An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (S
CVE-2023-31150 MEDIUM
6.5 May 10

A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automatio
CVE-2023-31165 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31164 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31163 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31160 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31159 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31158 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31157 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31156 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

CVE-2023-31155 MEDIUM
5.4 May 10

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer

Same weakness CWE-288 – Authentication Bypass Using an Alternate Path or Channel

View all
CVE-2024-1709 CRITICAL POC
10.0
CVE-2020-10148 CRITICAL POC
9.8
CVE-2024-55591 CRITICAL POC
9.8
CVE-2025-2747 CRITICAL POC
9.8
CVE-2025-2746 CRITICAL POC
9.8
CVE-2025-4427 MEDIUM POC
5.3
CVE-2025-34026 CRITICAL POC
9.2
CVE-2026-23760 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-31152 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy