Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.
See SEL Service Bulletin dated 2022-11-15 for more details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schweitzer Engineering Laboratories | SEL-3505 | R119-V0 – < R150-V2, R119-V0 – < R149-V4, R119-V0 – < R148-V7, R119-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3505-3 | R132-V0 – < R150-V2, R132-V0 – < R149-V4, R132-V0 – < R148-V7, R132-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3530 | R100-V0 – < R150-V2, R100-V0 – < R149-V4, R100-V0 – < R148-V7, R100-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3530-4 | R108-V0 – < R150-V2, R108-V0 – < R149-V4, R108-V0 – < R148-V7, R108-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3532 | R132-V0 – < R150-V2, R132-V0 – < R149-V4, R132-V0 – < R148-V7, R132-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3555 | R134-V0 – < R150-V2, R134-V0 – < R149-V4, R134-V0 – < R148-V7, R134-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3560S | R144-V2 – < R150-V2, R144-V2 – < R149-V4, R144-V2 – < R148-V7, R144-V2 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3560E | R144-V2 – < R150-V2, R144-V2 – < R149-V4, R144-V2 – < R148-V7, R144-V2 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-2241 RTAC module | R113-V0 – < R150-V2, R113-V0 – < R149-V4, R113-V0 – < R148-V7, R113-V0 – < R147-V6 | R150-V2 |
| Schweitzer Engineering Laboratories | SEL-3350 | R148-V0 – < R150-V2, R148-V0 – < R149-V4, R148-V0 – < R148-V7 | R150-V2 |