PT-2025-20709 · Schweitzer Engineering Laboratories · Sel-5037 Sel Grid Configurator

Published 2025-05-12 · Updated 2025-05-12 · CVE-2025-46737

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Schweitzer Engineering Laboratories SEL-5037 Grid Configurator versions prior to 6.4.0.58

Description The issue is related to an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources, leading to an Origin Validation Error.

Recommendations For versions prior to 6.4.0.58, update to version 6.4.0.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the data gateway service API to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2025-46737

Affected Products

Sel-5037 Sel Grid Configurator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-46737 · Security Note
• https://t.me/cvetracker/23627 · Telegram Post
• https://twitter.com/CVEnew/status/1921963507207307446 · Twitter Post
• https://t.me/latest_high_impact_cve/2341 · Telegram Post
• https://t.me/cvedetector/25107 · Telegram Post
• https://selinc.com/products/software/latest-software-versions · Note