CVE-2023-31149 Improper Input Validation in Web Interface
A remote authenticated attacker can execute arbitrary code on SEL RTAC devices due to improper input validation in the web interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31149?
CVE-2023-31149 is a critical code injection vulnerability in Schweitzer Engineering Laboratories SEL-2241 RTAC module, published on 10 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An Improper Input Validation vulnerability
in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code. See SEL Service Bulletin dated 2022-11-15 for more details.
Weakness: CWE-20
Which versions are affected by CVE-2023-31149?
It affects 10 products.
Products include Selinc Sel-2241 Rtac Module Firmware, Selinc Sel-3350 Firmware, Selinc Sel-3505-3 Firmware, Selinc Sel-3505 Firmware, Selinc Sel-3530-4 Firmware, Selinc Sel-3530 Firmware and 4 more.
How do I fix CVE-2023-31149?
No fix has been published for CVE-2023-31149 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-31149 being exploited?
There is no known exploitation of CVE-2023-31149 in the wild and no public exploit code.
Other vulnerabilities in Schweitzer Engineering Laboratories SEL-2241 RTAC module
Sources
Also known as GHSA-m3jw-3mmv-49cj.