CVE-2023-31166: Selinc Sel-2241 Rtac Module Firmware

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system. See SEL Service Bulletin dated 2022-11-15 for more details.

Affected products

Selinc Sel-2241 Rtac Module Firmware: from r126-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3350 Firmware: from r148-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3505-3 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3505 Firmware: from r126-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3530-4 Firmware: from r126-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3530 Firmware: from r126-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3532 Firmware: from r132-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3555 Firmware: from r134-v0, before r150-v2 (fixed in r150-v2)
Selinc Sel-3560e Firmware: from r144-v2, before r150-v2 (fixed in r150-v2)
Selinc Sel-3560s Firmware: from r144-v2, before r150-v2 (fixed in r150-v2)

Published 2023-05-10. Last modified 2026-06-17.