9.8

CVE-2023-31176

An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. 


See product Instruction Manual Appendix A dated 20230830 for more details.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Selinc ≫ Sel-451 Firmware Version >= r315-v0 < r315-v4
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r316-v0 < r316-v4
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r317-v0 < r317-v4
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r318-v0 < r318-v5
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r320-v0 < r320-v3
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r321-v0 < r321-v3
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r322-v0 < r322-v3
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r323-v0 < r323-v5
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r324-v0 < r324-v4
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Version >= r325-v0 < r325-v3
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Versionr326-v0
   Selinc ≫ Sel-451 Version-
Selinc ≫ Sel-451 Firmware Versionr327-v0
   Selinc ≫ Sel-451 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.323
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@selinc.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.