CVE-2023-31149CWE-20

Improper Input Validation in Web Interface

Critical · published May 10, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
65.0
In the wild
Unconfirmed
What it is

🚨 A crafty remote authenticated attacker could slip in and execute arbitrary code on the SEL RTAC Web Interface! 🔥 Think of it like a restaurant kitchen that trusts any delivery order without confirming the ingredients — one rogue chef could make whatever dish they want, causing chaos in the dining room! This vulnerability could lead to an attacker gaining full control over the system, allowing them to manipulate operations and potentially cause devastating outages. The consequences could be absolutely catastrophic for any infrastructure relying on SEL RTAC devices!

Put simply

Think of it like a restaurant kitchen that trusts any delivery order without confirming the ingredients — one rogue chef could make whatever dish they want, causing chaos in the dining room! The improper input validation flaw lets an authenticated user send malicious commands through the web interface, allowing for the execution of arbitrary code on the device.

What to do

This vulnerability could lead to an attacker gaining full control over the system, allowing them to manipulate operations and potentially cause devastating outages. The consequences could be absolutely catastrophic for any infrastructure relying on SEL RTAC devices! Immediately upgrade your SEL RTAC Web Interface to the latest version as outlined in the SEL Service Bulletin dated 2022-11-15. Additionally, review user access and ensure that authenticated users are only those who truly need it. You've got this! By taking these steps, you can secure your systems and keep the chaos at bay. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01086 · 65.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-05-10T19:20Z
EPSS history
Timeline
  • 10 MAY 19:20Z
    Improper Input Validation in Web Interface
    cvelistv5