Vendor
Schweitzer Engineering Laboratories
63 known vulnerabilities.
Schweitzer Engineering Laboratories at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 19 | 1 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Medium
Schweitzer Engineering Laboratories AcSELerator Improper Authorization Vulnerability
first Dec 22, 2013 -
Medium max 6.5ICSA-24-095-02 1 CVE
Schweitzer Engineering Laboratories SEL 700 series relays
Successful exploitation of this vulnerability could allow an attacker to make modifications or cause a denial-of-service condition.
-
Medium max 4.3ICSA-23-341-02 1 CVE
Schweitzer Engineering Laboratories SEL-411L
Successful exploitation of this vulnerability could expose authorized users to clickjacking attacks.
63 results · Feed
-
High 7.5
Deserialization of Untrusted Data
An authenticated user can modify application state data.
-
Critical 9.0
Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
-
Medium 4.3
Improper Control of Interaction Frequency
OpenFlow discovery protocol can exhaust resources because it is not rate limited
-
Low 3.7
Observable Response Discrepancy
Failed login response could be different depending on whether the username was local or central.
-
High 7.5
Improper Restriction of Excessive Authentication Attempts
Password guessing limits could be bypassed when using LDAP authentication.
-
Medium 6.3
Cross-Site Request Forgery
An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.
-
Medium 4.4
Authentication Bypass
SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings by importing a BIOS settings file with no password set.
-
Medium 4.3
Improper Neutralization of Input
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.
-
Low 2.7
Unverified Password Change
An authenticated user attempting to change their password could do so without using the current password.
-
Medium 5.7
Exposure of Sensitive System Information
An authenticated user without user-management permissions could identify other user accounts.
-
Medium 5.8
Error Message Contains Sensitive Information
An administrator could discover another account's credentials.
-
Medium 6.5
Improper Privilege Management
An authenticated user without user-management permissions could view other users account information.
-
Low 2.7
Improper Privilege Management
An authenticated administrator could modify the Created By username for a user account
-
Medium 4.3
Improper Access Control
Users who were required to change their password could still access system information before changing their password
-
Medium 5.7
Improper Privilege Management
A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.
-
High 7.5
Improper Handling of Insufficient Permissions
An authenticated user without user administrative permissions could change the administrator Account Name.
-
High 8.1
Improper Restriction of Excessive Authentication Attempts
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting
-
Medium 6.6
Deserialization of Untrusted Data
An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.
-
High 7.4
Origin Validation Error
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected…
-
Medium 6.5
Inclusion of Undocumented Features
Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G G…
-
Medium 4.3
Improper input validation could lead to reflection injection attacks
An Improper Input Validation vulnerability in Schweitzer Engineering Laboratories SEL-411L could allow an attacker to perform reflection attacks against an authorized and authenticated user. See product Instruction Manual Appendix A dated 20230830 for more de…
-
Medium 4.3
Improper neutralization of input during web page generation could lead to cross-site scripting based attacks
An Improper neutralization of input during web page generation in the Schweitzer Engineering Laboratories SEL-411L could allow an attacker to generate cross-site scripting based attacks against an authorized and authenticated user. See product Instruction Man…
-
Medium 4.3
Improper restriction of rendered UI layers or frames could lead to clickjacking attack
An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform clickjacking based attacks against an authenticated and authorized user. See product Instruction Man…
-
Medium 4.0
Improper input validition could lead to code injection
An improper input validation vulnerability in the Schweitzer Engineering Laboratories SEL-411L could allow a malicious actor to manipulate authorized users to click on a link that could allow undesired behavior. See product Instruction Manual Appendix A dated…
-
Medium 4.5
Improper input validation could lead to denial of service
An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service against the system and locking out services. See product Instruction Manual Appendix A dated 2023083…
-
Medium 4.5
Allocation of resources without limits could lead to denial of service
An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to make the system unavailable for an indefinite amount of time. See product Instruction Manua…
-
Medium 6.5
Improper authentication could lead to session hijacking
An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perform session hijacking attack and bypass authentication. See product Instruction Manual Appendix A date…
-
Medium 4.3
Improper neutralizataion of input could lead to execution of arbitrary code
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system. See product Instruction…
-
High 7.5
Insufficient entropy vulnerability could lead to authentication bypass
An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more…
-
High 8.2
Missing Authentication for Critical Function
A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manua…
-
High 7.4
Insecure Inherited Permissions
Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230…
-
High 8.8
Execution with Unnecessary Privileges
An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A a…
-
High 7.4
Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix …
-
High 7.7
Use of Hard-coded Credentials
Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL…
-
Medium 5.9
Incomplete Filtering of Special Elements
An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction …
-
Medium 5.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an …
-
Medium 5.9
Inclusion of Functionality from Untrusted Control Sphere
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. …
-
Medium 4.8
Improper Handling of Unicode Encoding
An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Man…
-
Medium 5.5
Inclusion of Functionality from Untrusted Control Sphere
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. …
-
Medium 5.0
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder Software on Windows allows Relative Path Traversal. SEL acSELerator Bay Screen Builder …