HighCVSS 7.5
EPSS 0.16%
An authenticated user can modify application state data.
Vendor
Schweitzer Engineering Laboratories vulnerabilities
63 published CVES affecting Schweitzer Engineering Laboratories, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 63
- Critical
- 5
- High
- 16
- Medium
- 39
- Low
- 3
- Unscored
- 0
- CISA KEV
- 0
Products
- SEL-3350 20
- SEL-3532 20
- SEL-3555 20
- SEL-3560E 20
- SEL-3560S 20
- SEL-2241 RTAC module 19
- SEL-3505 19
- SEL-3505-3 19
- SEL-3530 19
- SEL-3530-4 19
- SEL Blueframe OS 11
- SEL-5030 acSELerator QuickSet Software 6
- SEL-451 5
- SEL-411L 4
- SEL-5037 SEL Grid Configurator 4
- SEL-5056 Software-Defined Network Flow Controller 4
- SEL-5033 AcSELerator RTAC Software 3
- AcSELerator Architect 2
- Compass 1
- SEL-3350-1 1
- SEL-3355-2 1
- SEL-3360-2 1
- SEL-5036 acSELerator Bay Screen Builder Software 1
- SEL-5037 Grid Configurator 1
- SEL-700BT Motor Bus Transfer Relay 1
- SEL-700G Generator Protection Relay 1
- SEL-751 Feeder Protection Relay 1
- SEL-787-2/-3/-4 Transformer Protection Relay 1
- SEL-787Z High-Impedance Differential Relay 1
Latest Schweitzer Engineering Laboratories CVEs
Newest publication first · page 1 of 3
-
-
CriticalCVSS 9.0 EPSS 0.46%
Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
-
MediumCVSS 4.3 EPSS 0.23%
OpenFlow discovery protocol can exhaust resources because it is not rate limited
-
LowCVSS 3.7 EPSS 0.27%
Failed login response could be different depending on whether the username was local or central.
-
HighCVSS 7.5 EPSS 0.44%
Password guessing limits could be bypassed when using LDAP authentication.
-
MediumCVSS 6.3 EPSS 0.17%
An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.
-
CVE-2025-46750 Authentication Bypass
PublishedMediumCVSS 4.4 EPSS 0.17%SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings by importing a BIOS settings file with no password set.
-
MediumCVSS 4.3 EPSS 0.29%
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.
-
LowCVSS 2.7 EPSS 0.27%
An authenticated user attempting to change their password could do so without using the current password.
-
MediumCVSS 5.7 EPSS 0.33%
An authenticated user without user-management permissions could identify other user accounts.
-
MediumCVSS 5.8 EPSS 0.31%
An administrator could discover another account's credentials.
-
MediumCVSS 6.5 EPSS 0.33%
An authenticated user without user-management permissions could view other users account information.
-
LowCVSS 2.7 EPSS 0.27%
An authenticated administrator could modify the Created By username for a user account
-
CVE-2025-46742 Improper Access Control
PublishedMediumCVSS 4.3 EPSS 0.25%Users who were required to change their password could still access system information before changing their password
-
MediumCVSS 5.7 EPSS 0.15%
A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.
-
HighCVSS 7.5 EPSS 0.33%
An authenticated user without user administrative permissions could change the administrator Account Name.
-
HighCVSS 8.1 EPSS 0.39%
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting
-
MediumCVSS 6.6 EPSS 0.19%
An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.
-
CVE-2025-46737 Origin Validation Error
PublishedHighCVSS 7.4 EPSS 0.18%SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources.
-
MediumCVSS 6.5 EPSS 0.46%
Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection R...
-
MediumCVSS 5.4 EPSS 0.40%
An Improper Input Validation vulnerability in Schweitzer Engineering Laboratories SEL-411L could allow an attacker to perform reflection attacks against an authorized and authenticated user. See product Instruction Manual Appendix A dated 20230830 for more details.
-
MediumCVSS 6.1 EPSS 0.40%
An Improper neutralization of input during web page generation in the Schweitzer Engineering Laboratories SEL-411L could allow an attacker to generate cross-site scripting based attacks against an authorized and authenticated user. See product Instruction Manual Appendix A dated...
-
CVE-2023-2265 Improper restriction of rendered UI layers or frames could lead to clickjacking attack
PublishedMediumCVSS 6.1 EPSS 0.39%An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform clickjacking based attacks against an authenticated and authorized user. See product Instruction Manual Appendix A dated...
-
HighCVSS 7.8 EPSS 0.22%
An improper input validation vulnerability in the Schweitzer Engineering Laboratories SEL-411L could allow a malicious actor to manipulate authorized users to click on a link that could allow undesired behavior. See product Instruction Manual Appendix A dated 20230830 for more de...
-
MediumCVSS 6.5 EPSS 0.66%
An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service against the system and locking out services. See product Instruction Manual Appendix A dated 20230830 for more details.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.