Schweitzer Engineering Laboratories vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-48018 An authenticated user can modify application state data.High 7.5 · May 20, 2025
• CVE-2025-48017 Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of filesCritical 9 · May 20, 2025
• CVE-2025-48014 Password guessing limits could be bypassed when using LDAP authentication.High 7.5 · May 20, 2025
• CVE-2025-46740 An authenticated user without user administrative permissions could change the administrator Account Name.High 7.5 · May 12, 2025
• CVE-2025-46739 An unauthenticated user could discover account credentials via a brute-force attack without rate limitingHigh 8.1 · May 12, 2025
• CVE-2025-46737 SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application.High 7.4 · May 12, 2025
• CVE-2023-31176 An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tHigh 7.5 · Nov 30, 2023
• CVE-2023-34392 A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker High 8.2 · Aug 31, 2023
• CVE-2023-34391 Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/ManipulatingHigh 7.4 · Aug 31, 2023
• CVE-2023-31175 An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to runHigh 8.8 · Aug 31, 2023
• CVE-2023-31174 A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed inHigh 7.4 · Aug 31, 2023
• CVE-2023-31173 Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass.High 7.7 · Aug 31, 2023
• CVE-2023-31150 A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database systemHigh 8 · May 10, 2023
• CVE-2023-31149 An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a Critical 9.1 · May 10, 2023
• CVE-2023-31148 An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a rCritical 9.1 · May 10, 2023
• CVE-2018-10608 SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may caHigh 7.5 · Jul 24, 2018
• CVE-2018-10604 SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within theHigh 8.8 · Jul 24, 2018
• CVE-2018-10600 SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrCritical 9.8 · Jul 24, 2018