CVE-2023-31156: Selinc Sel-2241 Rtac Module Firmware

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL Service Bulletin dated 2022-11-15 for more details.

Affected products

Selinc Sel-2241 Rtac Module Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3350 Firmware: from r148-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3505-3 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3505 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3530-4 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3530 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3532 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3555 Firmware: from r134-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3560e Firmware: from r144-v2, before r150-v2 (fixed in r150-v2)
Selinc Sel-3560s Firmware: from r144-v2, before r150-v2 (fixed in r150-v2)

Published 2023-05-10. Last modified 2026-06-17.