Schweitzer Engineering Laboratories
60 CVEs across 27 Schweitzer Engineering Laboratories products. Browse Schweitzer Engineering Laboratories vulnerabilities, severities, and proof-of-concept exploits.
Schweitzer Engineering Laboratories products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48018 | High | 7.5 | 2025-05-20 | An authenticated user can modify application state data. |
CVE-2025-48017 | Critical | 9.0 | 2025-05-20 | Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files |
CVE-2025-48016 | Medium | 4.3 | 2025-05-20 | OpenFlow discovery protocol can exhaust resources because it is not rate limited |
CVE-2025-48015 | Low | 3.7 | 2025-05-20 | Failed login response could be different depending on whether the username was local or central. |
CVE-2025-48014 | High | 7.5 | 2025-05-20 | Password guessing limits could be bypassed when using LDAP authentication. |
CVE-2025-46750 | Medium | 4.4 | 2025-05-12 | SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings… |
CVE-2025-46749 | Medium | 4.3 | 2025-05-12 | An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution. |
CVE-2025-46748 | Low | 2.7 | 2025-05-12 | An authenticated user attempting to change their password could do so without using the current password. |
CVE-2025-46747 | Medium | 5.7 | 2025-05-12 | An authenticated user without user-management permissions could identify other user accounts. |
CVE-2025-46746 | Medium | 5.8 | 2025-05-12 | An administrator could discover another account's credentials. |
CVE-2025-46745 | Medium | 6.5 | 2025-05-12 | An authenticated user without user-management permissions could view other users account information. |
CVE-2025-46744 | Low | 2.7 | 2025-05-12 | An authenticated administrator could modify the Created By username for a user account |
CVE-2025-46743 | Medium | 6.3 | 2025-05-12 | An authenticated user's token could be used by another source after the user had logged out prior to the token expiring. |
CVE-2025-46742 | Medium | 4.3 | 2025-05-12 | Users who were required to change their password could still access system information before changing their password |
CVE-2025-46741 | Medium | 5.7 | 2025-05-12 | A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred. |
CVE-2025-46740 | High | 7.5 | 2025-05-12 | An authenticated user without user administrative permissions could change the administrator Account Name. |
CVE-2025-46739 | High | 8.1 | 2025-05-12 | An unauthenticated user could discover account credentials via a brute-force attack without rate limiting |
CVE-2025-46738 | Medium | 6.6 | 2025-05-12 | An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code. |
CVE-2025-46737 | High | 7.4 | 2025-05-12 | SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This… |
CVE-2024-2103 | Medium | 6.5 | 2024-04-04 | Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories… |
CVE-2023-34390 | Medium | 4.5 | 2023-11-30 | An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service… |
CVE-2023-34389 | Medium | 4.5 | 2023-11-30 | An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated att… |
CVE-2023-34388 | Medium | 6.5 | 2023-11-30 | An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perfor… |
CVE-2023-31177 | Medium | 4.3 | 2023-11-30 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an atta… |
CVE-2023-31176 | High | 7.5 | 2023-11-30 | An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session… |
CVE-2023-2267 | Medium | 4.3 | 2023-11-30 | An Improper Input Validation vulnerability in Schweitzer Engineering Laboratories SEL-411L could allow an attacker to perform reflection attacks against an aut… |
CVE-2023-2266 | Medium | 4.3 | 2023-11-30 | An Improper neutralization of input during web page generation in the Schweitzer Engineering Laboratories SEL-411L could allow an attacker to generate cross-si… |
CVE-2023-2265 | Medium | 4.3 | 2023-11-30 | An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform… |
CVE-2023-2264 | Medium | 4.0 | 2023-11-30 | An improper input validation vulnerability in the Schweitzer Engineering Laboratories SEL-411L could allow a malicious actor to manipulate authorized users to… |
CVE-2023-34392 | High | 8.2 | 2023-08-31 | A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker… |
CVE-2023-34391 | High | 7.4 | 2023-08-31 | Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulatin… |
CVE-2023-31175 | High | 8.8 | 2023-08-31 | An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to ru… |
CVE-2023-31174 | High | 7.4 | 2023-08-31 | A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed i… |
CVE-2023-31173 | High | 7.7 | 2023-08-31 | Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. S… |
CVE-2023-31172 | Medium | 5.9 | 2023-08-31 | An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an att… |
CVE-2023-31171 | Medium | 5.9 | 2023-08-31 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSE… |
CVE-2023-31170 | Medium | 5.9 | 2023-08-31 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software co… |
CVE-2023-31169 | Medium | 4.8 | 2023-08-31 | An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attack… |
CVE-2023-31168 | Medium | 5.5 | 2023-08-31 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software co… |
CVE-2023-31167 | Medium | 5.0 | 2023-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Sc… |
CVE-2023-31166 | Medium | 4.1 | 2023-05-10 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation… |
CVE-2023-31165 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31164 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31163 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31162 | Medium | 4.8 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a re… |
CVE-2023-31161 | Medium | 5.9 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an a… |
CVE-2023-31160 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31159 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31158 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31157 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31156 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31155 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31154 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Aut… |
CVE-2023-31153 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Auto… |
CVE-2023-31152 | Medium | 4.0 | 2023-05-10 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC)… |
CVE-2023-31151 | Medium | 4.7 | 2023-05-10 | An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could a… |
CVE-2023-31150 | High | 8.0 | 2023-05-10 | A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database syste… |
CVE-2023-31149 | Critical | 9.1 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a… |
CVE-2023-31148 | Critical | 9.1 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a… |
CVE-2023-2310 | Medium | 6.8 | 2023-05-10 | A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote a… |