Improper restriction of rendered UI layers or frames could lead to clickjacking attack
Priority LOW 27CWE-1021Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1021.
Summary
An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform clickjacking based attacks against an authenticated and authorized user. See product Instruction Manual Appendix A dated 20230830 for more details.
Why it matters now
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed SEL-411L (Schweitzer Engineering Laboratories): R118-V4, R119-V5, R120-V6 +9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schweitzer Engineering Laboratories | SEL-411L | R118-V0 to before R118-V4; R119-V0 to before R119-V5; R120-V0 to before R120-V6; R121-V0 to before R121-V3; R122-V0 to before R122-V3; R123-V0 to before R123-V3; R124-V0 to before R124-V3; R125-V0 to before R125-V3; R126-V0 to before R126-V4; R127-V0 to before R127-V2; R128-V0 to before R128-V1; R129-V0 to before R129-V1 | R118-V4, R119-V5, R120-V6, R121-V3, R122-V3, R123-V3, R124-V3, R125-V3, R126-V4, R127-V2, R128-V1, R129-V1 | Patch available | CNA |
- SEL-411L VendorSchweitzer Engineering Laboratories Affected R118-V0 to before R118-V4; R119-V0 to before R119-V5; R120-V0 to before R120-V6; R121-V0 to before R121-V3; R122-V0 to before R122-V3; R123-V0 to before R123-V3; R124-V0 to before R124-V3; R125-V0 to before R125-V3; R126-V0 to before R126-V4; R127-V0 to before R127-V2; R128-V0 to before R128-V1; R129-V0 to before R129-V1 Fixed in R118-V4, R119-V5, R120-V6, R121-V3, R122-V3, R123-V3, R124-V3, R125-V3, R126-V4, R127-V2, R128-V1, R129-V1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:selinc:sel-411l_firmware:*:*:*:*:*:*:*:* | r118-v0 to before r118-v4; r119-v0 to before r119-v5; r120-v0 to before r120-v6; r121-v0 to before r121-v3; r122-v0 to before r122-v3; r123-v0 to before r123-v3; r124-v0 to before r124-v3; r125-v0 to before r125-v3; r126-v0 to before r126-v4; r127-v0 to before r127-v2 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-411l_firmware:r128-v0:*:*:*:*:*:*:* | r128-v0 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-411l_firmware:r129-v0:*:*:*:*:*:*:* | r129-v0 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:h:selinc:sel-411l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schweitzer Engineering Laboratories |
- cpe:2.3:o:selinc:sel-411l_firmware:*:*:*:*:*:*:*:* Versions r118-v0 to before r118-v4; r119-v0 to before r119-v5; r120-v0 to before r120-v6; r121-v0 to before r121-v3; r122-v0 to before r122-v3; r123-v0 to before r123-v3; r124-v0 to before r124-v3; r125-v0 to before r125-v3; r126-v0 to before r126-v4; r127-v0 to before r127-v2 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-411l_firmware:r128-v0:*:*:*:*:*:*:* Versions r128-v0 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-411l_firmware:r129-v0:*:*:*:*:*:*:* Versions r129-v0 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:h:selinc:sel-411l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schweitzer Engineering Laboratories
Remediation
- Fix · CNA SEL-411L (Schweitzer Engineering Laboratories) Fixed in R118-V4, R119-V5, R120-V6, R121-V3, R122-V3, R123-V3, R124-V3, R125-V3, R126-V4, R127-V2, R128-V1, R129-V1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Schweitzer Engineering Laboratories SEL-411L R118-V4, R119-V5 and 10 more versions
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2023-02123 Improper input validition could lead to code injectionPriority LOW 33
- TI-2023-02125 Improper neutralization of input during web page generation could lead to cross-site scripting based attacksPriority LOW 27
- TI-2023-02126 Improper input validation could lead to reflection injection attacksPriority LOW 25
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2265
- 2026-10-03 Alias added: GHSA-fq9r-p3cq-895q
References
More Schweitzer Engineering Laboratories Sel-411l Firmware vulnerabilities
- TI-2023-02123 Improper input validition could lead to code injection CVSS 3.1HIGH 7.8
- TI-2023-02125 Improper neutralization of input during web page generation could lead to cross-site scripting based attacks CVSS 3.1MEDIUM 6.1
- TI-2023-02126 Improper input validation could lead to reflection injection attacks CVSS 3.1MEDIUM 5.4
Sources
- CVE-2023-2265 · CVE Program
- CVE-2023-2265 · NVD
- FIRST EPSS
- GHSA-fq9r-p3cq-895q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences