Schweitzer Engineering Laboratories AcSELerator Improper Authorization Vulnerability

Overview This advisory provides mitigation details for a vulnerability affecting the Schweitzer Engineering Laboratories SEL AcSELerator QuickSet software. Independent researcher Michael Toecker of Digital Bond has identified an improper authorization vulnerability in the SEL AcSELerator...

CVE-2013-2792

CVE-2013-2792 affects Schweitzer Engineering Laboratories SEL-2241, SEL-3505, and SEL-3530 RTAC master devices. It arises from improper input validation of DNP3 over TCP, allowing remote attackers to cause an infinite loop and denial of service. Public references in NVD/NIST report a base score o...

CVE-2013-2798

CVE-2013-2798 affects SEL-2241, SEL-3505, and SEL-3530 RTAC master devices. The vulnerability is due to improper input validation that can cause an infinite loop when processing crafted input over a serial line, potentially crashing the device. The issue has both serial (local) and IP-based varia...

CVE-2013-0665

Schweitzer Engineering Laboratories SEL AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations...

Code injection

Schweitzer Engineering Laboratories SEL AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations...

CVE-2013-0665

Schweitzer Engineering Laboratories SEL AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations...

CVE-2013-0665

The CVE affects SEL AcSELerator QuickSet prior to version 5.12.0.1. Root cause: weak permissions in the Program Files directory permit any local user to replace executables, enabling privilege escalation when the application runs. Impact per sources: local privilege compromise affecting the Quick...

Schweitzer Engineering Laboratories (SEL) Default telnet Account Detection (SCADA)

Binary data 6269.prm...

Directory traversal

Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langsel parameter to 1 updater.php and 2 thumber.php...