Use of Hard-coded Credentials
CVE-2023-31173

7.7HIGH

Key Information:

Vendor

Schweitzer Engineering Laboratories

Status
Sel-5037 Sel Grid Configurator
Vendor
CVE Published:
31 August 2023

What is CVE-2023-31173?

A security issue has been identified in the SEL-5037 Grid Configurator by Schweitzer Engineering Laboratories, where hard-coded credentials allow authentication bypass. This vulnerability can potentially enable unauthorized access to sensitive systems, posing significant risks. Users are advised to upgrade to SEL Grid Configurator version 4.5.0.20 or later in order to mitigate these security concerns. For detailed guidance, refer to the Instruction Manual Appendices dated June 15, 2023.

Affected Version(s)

SEL-5037 SEL Grid Configurator Windows 0 < 4.5.0.20

References

https://selinc.com/support/security-notifications/externa...
https://www.nozominetworks.com/blog/

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella of Nozomi Networks
.