CVE-2023-31162: Schweitzer Engineering Laboratories SEL-3505

Описание

Оригинално описание

An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to arbitrarily alter the content of a configuration file. See SEL Service Bulletin dated 2022-11-15 for more details.

Засегнати продукти

• Schweitzer Engineering Laboratories SEL-3505: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3505-3: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3530: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3530-4: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3532: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3555: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3560S: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3560E: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-2241 RTAC module: R149-V0 преди R150-V2; R149-V0 преди R149-V4
• Schweitzer Engineering Laboratories SEL-3350: R149-V0 преди R150-V2; R149-V0 преди R149-V4

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в Schweitzer Engineering Laboratories SEL-3505

• 4.1CVE-2023-31166
• 4.3CVE-2023-31165
• 4.3CVE-2023-31164
• 4.3CVE-2023-31163
• 5.9CVE-2023-31161

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-31162
• https://nvd.nist.gov/vuln/detail/CVE-2023-31162
• https://selinc.com/support/security-notifications/external-reports/
• https://www.nozominetworks.com/blog/