Cyber Resilience

CVE-2023-31150

High

Published: 10 May 2023

Published
10 May 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0024 47.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-31150 is a high-severity Storing Passwords in a Recoverable Format (CWE-257) vulnerability in Selinc Sel-2241 Rtac Module Firmware. Its CVSS base score is 8.0 (High).

Operationally, ranked at the 47.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords. See SEL Service Bulletin dated 2022-11-15 for more details.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

selinc
sel-2241 rtac module firmware
r122-v0 — r150-v2
selinc
sel-3350 firmware
r148-v0 — r150-v2
selinc
sel-3505 firmware
r122-v0 — r150-v2
selinc
sel-3505-3 firmware
r132-v0 — r150-v2
selinc
sel-3530 firmware
r122-v0 — r150-v2
selinc
sel-3530-4 firmware
r122-v0 — r150-v2
selinc
sel-3532 firmware
r132-v0 — r150-v2
selinc
sel-3555 firmware
r134-v0 — r150-v2
selinc
sel-3560e firmware
r144-v2 — r150-v2
selinc
sel-3560s firmware
r144-v2 — r150-v2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-922

Tracking information locations and access supports secure storage practices instead of insecure ones.

addresses: CWE-922

Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.

addresses: CWE-922

Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.

addresses: CWE-922

Policy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.

addresses: CWE-922

Proper categorization drives selection of storage controls that keep sensitive information from being stored insecurely.

addresses: CWE-922

The control explicitly requires secure storage mechanisms for sensitive information, closing the insecure-storage weakness class.

addresses: CWE-922

Storing information as fragments on distinct components is an architectural control that avoids insecure single-location storage of the complete sensitive data set.

addresses: CWE-922

OPSEC requirements improve handling and storage practices for sensitive supply-chain information.

References