Improper access control in Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622
Priority MEDIUM 47CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may allow for unauthorized communications to downstream devices.
Why it matters now
EPSS 0.02273 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 | Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 | — | No fix listed | CNA |
- Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 Vendor— Affected Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:selinc:sel-3620_firmware:r202:*:*:*:*:*:*:* | r202 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3620_firmware:r203:*:*:*:*:*:*:* | r203 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3620_firmware:r203-v:*:*:*:*:*:*:* | r203-v | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3620_firmware:r203-v1:*:*:*:*:*:*:* | r203-v1 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3620_firmware:r204:*:*:*:*:*:*:* | r204 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3620_firmware:r204-v1:*:*:*:*:*:*:* | r204-v1 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:h:selinc:sel-3620:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3622_firmware:r202:*:*:*:*:*:*:* | r202 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3622_firmware:r203:*:*:*:*:*:*:* | r203 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3622_firmware:r203-v:*:*:*:*:*:*:* | r203-v | Vulnerable | Schweitzer Engineering Laboratories |
- cpe:2.3:o:selinc:sel-3620_firmware:r202:*:*:*:*:*:*:* Versions r202 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3620_firmware:r203:*:*:*:*:*:*:* Versions r203 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3620_firmware:r203-v:*:*:*:*:*:*:* Versions r203-v Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3620_firmware:r203-v1:*:*:*:*:*:*:* Versions r203-v1 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3620_firmware:r204:*:*:*:*:*:*:* Versions r204 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3620_firmware:r204-v1:*:*:*:*:*:*:* Versions r204-v1 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:h:selinc:sel-3620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3622_firmware:r202:*:*:*:*:*:*:* Versions r202 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3622_firmware:r203:*:*:*:*:*:*:* Versions r203 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3622_firmware:r203-v:*:*:*:*:*:*:* Versions r203-v Vulnerable ·Schweitzer Engineering Laboratories
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:selinc:sel-3622_firmware:r203-v1:*:*:*:*:*:*:* | r203-v1 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3622_firmware:r204:*:*:*:*:*:*:* | r204 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-3622_firmware:r204-v1:*:*:*:*:*:*:* | r204-v1 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:h:selinc:sel-3622:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schweitzer Engineering Laboratories |
- cpe:2.3:o:selinc:sel-3622_firmware:r203-v1:*:*:*:*:*:*:* Versions r203-v1 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3622_firmware:r204:*:*:*:*:*:*:* Versions r204 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-3622_firmware:r204-v1:*:*:*:*:*:*:* Versions r204-v1 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:h:selinc:sel-3622:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schweitzer Engineering Laboratories
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7928
- 2026-10-03 Alias added: GHSA-g89g-4g7j-cgmm
References
Sources
- CVE-2017-7928 · CVE Program
- CVE-2017-7928 · NVD
- FIRST EPSS
- GHSA-g89g-4g7j-cgmm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences