CVE-2023-31148 Improper Input Validation in Web Interface
Remote authenticated attackers can execute arbitrary code via improper input validation in the SEL RTAC Web Interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31148?
CVE-2023-31148 is a critical code injection vulnerability in Schweitzer Engineering Laboratories SEL-2241 RTAC module, published on 10 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An Improper Input Validation vulnerability
in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code. See SEL Service Bulletin dated 2022-11-15 for more details.
Weakness: CWE-20
Which versions are affected by CVE-2023-31148?
It affects 10 products.
Products include Selinc Sel-2241 Rtac Module Firmware, Selinc Sel-3350 Firmware, Selinc Sel-3505-3 Firmware, Selinc Sel-3505 Firmware, Selinc Sel-3530-4 Firmware, Selinc Sel-3530 Firmware and 4 more.
How do I fix CVE-2023-31148?
No fix has been published for CVE-2023-31148 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-31148 being exploited?
There is no known exploitation of CVE-2023-31148 in the wild and no public exploit code.
Other vulnerabilities in Schweitzer Engineering Laboratories SEL-2241 RTAC module
Sources
Also known as GHSA-p988-gmr3-hxrg.