CVE-2023-2310

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service.

See the ACSELERATOR RTAC SEL-5033 Software instruction manual date code 20210915 for more details.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-300

Affected software

Vendor	Product	Versions
Schweitzer Engineering Laboratories	SEL-3505	>= R119-V0, < R150-V2; >= R119-V0, < R149-V4; >= R119-V0, < R148-V7; >= R119-V0, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3505-3	>= R132-V0, < R150-V2; >= R132-V0, < R149-V4; >= R132-V0, < R148-V7; >= R132-V0, < R147-V6
Schweitzer Engineering Laboratories	SEL-3530	>= R100-V0, < R150-V2; >= R100-V0, < R149-V4; >= R100-V0, < R148-V7; >= R100-V0, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3530-4	>= R108-V0, < R150-V2; >= R108-V0, < R149-V4; >= R108-V0, < R148-V7; >= R108-V0, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3532	>= R132-V0, < R150-V2; >= R132-V0, < R149-V4; >= R132-V0, < R148-V7; >= R132-V0, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3555	>= R134-V0, < R150-V2; >= R134-V0, < R149-V4; >= R134-V0, < R148-V7; >= R134-V0, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3560S	>= R144-V2, < R150-V2; >= R144-V2, < R149-V4; >= R144-V2, < R148-V7; >= R144-V2, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3560E	>= R144-V2, < R150-V2; >= R144-V2, < R149-V4; >= R144-V2, < R148-V7; >= R144-V2, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-2241 RTAC module	>= R113-V0, < R150-V2; >= R113-V0, < R149-V4; >= R113-V0, < R148-V7; >= R113-V0, < R147-V6
Schweitzer Engineering Laboratories, Inc.	SEL-3350	>= R148-V0, < R150-V2; >= R148-V0, < R149-V4; >= R148-V0, < R148-V7

References

https://selinc.com/support/security-notifications/external-reports/Vendor Advisory
https://selinc.com/support/security-notifications/external-reports/Vendor Advisory

Timeline

Published: May 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-231087.5In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in t CVE-2023-231097.5In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the f CVE-2023-23116.5Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem re CVE-2023-231107.4An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware i CVE-2023-231195.9The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmwar CVE-2023-23128.8Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer proc CVE-2023-231205.9The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera f CVE-2023-231266.1Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintend CVE-2023-231275.3In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's pos CVE-2023-231286.1Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have CVE-2023-23138.8Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the CVE-2023-231305.9Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled.