Improper authentication could lead to session hijacking
Priority MEDIUM 44CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perform session hijacking attack and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00913 60th percentileScored 2026-11-07
Fix Fixed SEL-451 (Schweitzer Engineering Laboratories): R315-V4, R316-V4, R317-V4 +9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schweitzer Engineering Laboratories | SEL-451 | R315-V0 to before R315-V4; R316-V0 to before R316-V4; R317-V0 to before R317-V4; R318-V0 to before R318-V5; R320-V0 to before R320-V3; R321-V0 to before R321-V3; R322-V0 to before R322-V3; R323-V0 to before R323-V5; R324-V0 to before R324-V4; R325-V0 to before R325-V3; R326-V0 to before R326-V1; R327-V0 to before R327-V1 | R315-V4, R316-V4, R317-V4, R318-V5, R320-V3, R321-V3, R322-V3, R323-V5, R324-V4, R325-V3, R326-V1, R327-V1 | Patch available | CNA |
- SEL-451 VendorSchweitzer Engineering Laboratories Affected R315-V0 to before R315-V4; R316-V0 to before R316-V4; R317-V0 to before R317-V4; R318-V0 to before R318-V5; R320-V0 to before R320-V3; R321-V0 to before R321-V3; R322-V0 to before R322-V3; R323-V0 to before R323-V5; R324-V0 to before R324-V4; R325-V0 to before R325-V3; R326-V0 to before R326-V1; R327-V0 to before R327-V1 Fixed in R315-V4, R316-V4, R317-V4, R318-V5, R320-V3, R321-V3, R322-V3, R323-V5, R324-V4, R325-V3, R326-V1, R327-V1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:selinc:sel-451_firmware:*:*:*:*:*:*:*:* | r315-v0 to before r315-v4; r316-v0 to before r316-v4; r317-v0 to before r317-v4; r318-v0 to before r318-v5; r320-v0 to before r320-v3; r321-v0 to before r321-v3; r322-v0 to before r322-v3; r323-v0 to before r323-v5; r324-v0 to before r324-v4; r325-v0 to before r325-v3 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-451_firmware:r326-v0:*:*:*:*:*:*:* | r326-v0 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:o:selinc:sel-451_firmware:r327-v0:*:*:*:*:*:*:* | r327-v0 | Vulnerable | Schweitzer Engineering Laboratories |
| cpe:2.3:h:selinc:sel-451:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schweitzer Engineering Laboratories |
- cpe:2.3:o:selinc:sel-451_firmware:*:*:*:*:*:*:*:* Versions r315-v0 to before r315-v4; r316-v0 to before r316-v4; r317-v0 to before r317-v4; r318-v0 to before r318-v5; r320-v0 to before r320-v3; r321-v0 to before r321-v3; r322-v0 to before r322-v3; r323-v0 to before r323-v5; r324-v0 to before r324-v4; r325-v0 to before r325-v3 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-451_firmware:r326-v0:*:*:*:*:*:*:* Versions r326-v0 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:o:selinc:sel-451_firmware:r327-v0:*:*:*:*:*:*:* Versions r327-v0 Vulnerable ·Schweitzer Engineering Laboratories
- cpe:2.3:h:selinc:sel-451:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schweitzer Engineering Laboratories
Remediation
- Fix · CNA SEL-451 (Schweitzer Engineering Laboratories) Fixed in R315-V4, R316-V4, R317-V4, R318-V5, R320-V3, R321-V3, R322-V3, R323-V5, R324-V4, R325-V3, R326-V1, R327-V1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Schweitzer Engineering Laboratories SEL-451 R315-V4, R316-V4 and 10 more versions
5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2023-14886 Insufficient entropy vulnerability could lead to authentication bypassPriority MEDIUM 50
- TI-2023-17220 Improper input validation could lead to denial of servicePriority LOW 30
- TI-2023-17219 Allocation of resources without limits could lead to denial of servicePriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34388
- 2026-10-03 Alias added: GHSA-592f-7j4r-r9vv
References
More Schweitzer Engineering Laboratories Sel-451 Firmware vulnerabilities
- TI-2023-14886 Insufficient entropy vulnerability could lead to authentication bypass CVSS 3.1CRITICAL 9.8
- TI-2023-17220 Improper input validation could lead to denial of service CVSS 3.1MEDIUM 6.5
- TI-2023-17219 Allocation of resources without limits could lead to denial of service CVSS 3.1MEDIUM 6.5
- TI-2023-14887 Improper neutralizataion of input could lead to execution of arbitrary code CVSS 3.1MEDIUM 6.1
Sources
- CVE-2023-34388 · CVE Program
- CVE-2023-34388 · NVD
- FIRST EPSS
- GHSA-592f-7j4r-r9vv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences