PT-2023-5212 · Schweitzer Engineering Laboratories · Sel Grid Configurator

Andrea Palanca · Published 2023-06-15 · Updated 2023-09-05 · CVE-2023-31174

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator versions prior to 4.5.0.20

Description A Cross-Site Request Forgery (CSRF) issue affects the SEL Grid Configurator, allowing an attacker to embed instructions that could be executed by an authorized device operator. This is due to insufficient authentication of executed requests. The issue can be exploited by a remote attacker to perform a CSRF attack.

Recommendations For versions prior to 4.5.0.20, update to version 4.5.0.20 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication measures to verify the authenticity of requests. Restrict access to the SEL Grid Configurator to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2023-05820

CVE-2023-31174

Affected Products

Sel Grid Configurator

References · 7

• https://selinc.com/support/security-notifications/external-reports · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31174 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31174 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05820 · Security Note
• https://t.me/cibsecurity/69567 · Telegram Post
• https://nozominetworks.com/blog/9-new-vulnerabilities-impact-schweitzer-engineering-labs-software · Note
• https://nozominetworks.com/blog · Note