CVE-2017-7928 An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The de...
CriticalCVSS 10.0
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may allow for unauthorized communications to downstream devices.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| selinc sel-3620 firmware | = r202 | No fix listed |
| selinc sel-3620 firmware | = r203 | No fix listed |
| selinc sel-3620 firmware | = r203-v | No fix listed |
| selinc sel-3620 firmware | = r203-v1 | No fix listed |
| selinc sel-3620 firmware | = r204 | No fix listed |
| selinc sel-3620 firmware | = r204-v1 | No fix listed |
| selinc sel-3622 firmware | = r202 | No fix listed |
| selinc sel-3622 firmware | = r203 | No fix listed |
| selinc sel-3622 firmware | = r203-v | No fix listed |
| selinc sel-3622 firmware | = r203-v1 | No fix listed |
| selinc sel-3622 firmware | = r204 | No fix listed |
| selinc sel-3622 firmware | = r204-v1 | No fix listed |
References
- 99536 third-party-advisory vdb-entry
- ics-cert.us-cert.gov mitigation third-party-advisory us-government-resource