Improper input validition could lead to code injection
Priority LOW 33CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An improper input validation vulnerability in the Schweitzer Engineering Laboratories SEL-411L could allow a malicious actor to manipulate authorized users to click on a link that could allow undesired behavior. See product Instruction Manual Appendix A dated 20230830 for more details.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 12th percentileScored 2026-11-09
Fix Fixed SEL-411L (Schweitzer Engineering Laboratories): R118-V4, R119-V5, R120-V6 +9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schweitzer Engineering Laboratories | SEL-411L | R118-V0 to before R118-V4; R119-V0 to before R119-V5; R120-V0 to before R120-V6; R121-V0 to before R121-V3; R122-V0 to before R122-V3; R123-V0 to before R123-V3; R124-V0 to before R124-V3; R125-V0 to before R125-V3; R126-V0 to before R126-V4; R127-V0 to before R127-V2; R128-V0 to before R128-V1; R129-V0 to before R129-V1 | R118-V4, R119-V5, R120-V6, R121-V3, R122-V3, R123-V3, R124-V3, R125-V3, R126-V4, R127-V2, R128-V1, R129-V1 | Patch available | CNA |
- SEL-411L VendorSchweitzer Engineering Laboratories Affected R118-V0 to before R118-V4; R119-V0 to before R119-V5; R120-V0 to before R120-V6; R121-V0 to before R121-V3; R122-V0 to before R122-V3; R123-V0 to before R123-V3; R124-V0 to before R124-V3; R125-V0 to before R125-V3; R126-V0 to before R126-V4; R127-V0 to before R127-V2; R128-V0 to before R128-V1; R129-V0 to before R129-V1 Fixed in R118-V4, R119-V5, R120-V6, R121-V3, R122-V3, R123-V3, R124-V3, R125-V3, R126-V4, R127-V2, R128-V1, R129-V1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:selinc:sel-411l_firmware:*:*:*:*:*:*:*:* | r118-v0 to before r118-v4; r119-v0 to before r119-v5; r120-v0 to before r120-v6; r121-v0 to before r121-v3; r122-v0 to before r122-v3; r123-v0 to before r123-v3; r124-v0 to before r124-v3; r125-v0 to before r125-v3; r126-v0 to before r126-v4; r127-v0 to before r127-v2 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-411l_firmware:r128-v0:*:*:*:*:*:*:* | r128-v0 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-411l_firmware:r129-v0:*:*:*:*:*:*:* | r129-v0 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:h:selinc:sel-411l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schweitzer Engineering Laboratories |
- cpe:2.3:o:selinc:sel-411l_firmware:*:*:*:*:*:*:*:* Versions r118-v0 to before r118-v4; r119-v0 to before r119-v5; r120-v0 to before r120-v6; r121-v0 to before r121-v3; r122-v0 to before r122-v3; r123-v0 to before r123-v3; r124-v0 to before r124-v3; r125-v0 to before r125-v3; r126-v0 to before r126-v4; r127-v0 to before r127-v2 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-411l_firmware:r128-v0:*:*:*:*:*:*:* Versions r128-v0 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-411l_firmware:r129-v0:*:*:*:*:*:*:* Versions r129-v0 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:h:selinc:sel-411l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schweitzer Engineering Laboratories
Remediation
- Fix · CNA SEL-411L (Schweitzer Engineering Laboratories) Fixed in R118-V4, R119-V5, R120-V6, R121-V3, R122-V3, R123-V3, R124-V3, R125-V3, R126-V4, R127-V2, R128-V1, R129-V1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Schweitzer Engineering Laboratories SEL-411L R118-V4, R119-V5 and 10 more versions
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2023-02125 Improper neutralization of input during web page generation could lead to cross-site scripting based attacksPriority LOW 27
- TI-2023-02124 Improper restriction of rendered UI layers or frames could lead to clickjacking attackPriority LOW 27
- TI-2023-02126 Improper input validation could lead to reflection injection attacksPriority LOW 25
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2264
- 2026-10-03 Alias added: GHSA-9vh5-qcwf-6gp4
References
More Schweitzer Engineering Laboratories Sel-411l Firmware vulnerabilities
- TI-2023-02125 Improper neutralization of input during web page generation could lead to cross-site scripting based attacks CVSS 3.1MEDIUM 6.1
- TI-2023-02124 Improper restriction of rendered UI layers or frames could lead to clickjacking attack CVSS 3.1MEDIUM 6.1
- TI-2023-02126 Improper input validation could lead to reflection injection attacks CVSS 3.1MEDIUM 5.4
Sources
- CVE-2023-2264 · CVE Program
- CVE-2023-2264 · NVD
- FIRST EPSS
- GHSA-9vh5-qcwf-6gp4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences