CVE-2023-31161 Improper Input Validation in Web Interface
Authenticated attackers can exploit improper input validation in the SEL RTAC web interface to access internal resources, requiring vendor patches.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-31161?
CVE-2023-31161 is a medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-3350, published on 10 May 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an authenticated remote attacker to use internal resources, allowing a variety of potential effects.
See SEL Service Bulletin dated 2022-11-15 for more details.
Weakness: CWE-20
Which versions are affected by CVE-2023-31161?
It affects 5 products.
Products include Selinc Sel-3350 Firmware, Selinc Sel-3532 Firmware, Selinc Sel-3555 Firmware, Selinc Sel-3560e Firmware, Selinc Sel-3560s Firmware.
How do I fix CVE-2023-31161?
No fix has been published for CVE-2023-31161 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-31161 being exploited?
There is no known exploitation of CVE-2023-31161 in the wild and no public exploit code.
Sources
Also known as GHSA-r3qm-hp4j-w68f.