CVE-2023-2310
Published: 10 May 2023
Summary
CVE-2023-2310 is a medium-severity Channel Accessible by Non-Endpoint (CWE-300) vulnerability in Selinc Sel-2241 Rtac Module Firmware. Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 37.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-33815
Vulnerability details
A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service. See the ACSELERATOR RTAC SEL-5033 Software instruction…
more
manual date code 20210915 for more details.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures only authenticated endpoints can access the communication channel, blocking unauthorized non-endpoint access.
Physically restricts transmission channels so they cannot be accessed or tapped by non-endpoint actors within facilities.
Periodic TSCM surveys identify unauthorized access points or taps that make communication channels reachable by non-endpoint adversaries.
Explicitly isolates the communications path so it cannot be accessed or intercepted by non-endpoint entities during security functions.
Restrictions and channel controls reduce the chance that VoIP media or signaling streams remain accessible to non-participants.
Directly prevents non-endpoint access or interception of the session communication path.
An out-of-band channel is inaccessible to non-endpoints that can observe or interfere with the primary communication channel.
The control restricts an inherently broadcast wireless channel to only intended endpoints, mitigating accessibility by non-endpoints.