Read the docs
TI-2025-29421 Aliases CVE-2025-46750GHSA-9j22-g5g3-cw39

Authentication bypass in Schweitzer Engineering Laboratories SEL-3350-1

Priority LOW 20CWE-305Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings by importing a BIOS settings file with no password set.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Fixed SEL-3350-1 (Schweitzer Engineering Laboratories): 1.3.49152.117SEL-3355-2 (Schweitzer Engineering Laboratories): 2.6.49152.98+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schweitzer Engineering LaboratoriesSEL-3350-1before 1.3.49152.1171.3.49152.117Patch availableCNA
Schweitzer Engineering LaboratoriesSEL-3355-2before 2.6.49152.982.6.49152.98Patch availableCNA
Schweitzer Engineering LaboratoriesSEL-3360-2before 2.6.49152.982.6.49152.98Patch availableCNA

Remediation

  • Fix · CNA SEL-3350-1 (Schweitzer Engineering Laboratories) Fixed in 1.3.49152.117
  • Fix · CNA SEL-3355-2 (Schweitzer Engineering Laboratories) Fixed in 2.6.49152.98
  • Fix · CNA SEL-3360-2 (Schweitzer Engineering Laboratories) Fixed in 2.6.49152.98

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46750
  2. 2026-10-03 Alias added: GHSA-9j22-g5g3-cw39

References

Other 1

  • TI-2023-14886 Insufficient entropy vulnerability could lead to authentication bypass CVSS 3.1CRITICAL 9.8
  • TI-2018-07489 XML external entity injection in Schweitzer Engineering Laboratories AcSELerator Architect CVSS 3.0CRITICAL 9.8
  • TI-2017-05537 Improper access control in Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 CVSS 3.0CRITICAL 10.0
  • TI-2023-17218 Improper authentication could lead to session hijacking CVSS 3.1CRITICAL 9.8
  • TI-2023-14885 Execution with Unnecessary Privileges CVSS 3.1CRITICAL 9.8
  • TI-2023-14859 Improper Input Validation in Web Interface CVSS 3.1CRITICAL 9.1
See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences