CVE-2024-2103
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-2103 is a medium-severity Inclusion of Undocumented Features or Chicken Bits (CWE-1242) vulnerability in Selinc (inferred from references). Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27067
Vulnerability Data
Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5 Motor Protection…
more
Relay, SEL-751 Feeder Protection Relay, SEL-787-2/-3/-4 Transformer Protection Relay, SEL-787Z High-Impedance Differential Relay . See product instruction manual appendix A dated 20240308 for more details regarding the SEL-751 Feeder Protection Relay. For more information for the other affected products, see their instruction manuals dated 20240329.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4
Mitigating Controls (NIST 800-53 r5) AI
Least-functionality configuration can disable or remove non-essential capabilities once discovered, limiting the blast radius of any undocumented chicken bits that remain.
Documented development standards and processes directly require that all device features be specified and recorded, preventing hidden chicken bits from being introduced.
An SDLC that incorporates security requires all features to be captured in requirements and design artifacts, stopping undocumented capabilities from being added.
Security engineering principles applied during design explicitly call for complete, documented functionality and the avoidance of hidden or undeclared mechanisms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle requires documented design and review, reducing hidden or undocumented features.
A.8.27 mandates security-by-design, defence-in-depth, least privilege, assume-breach, distrust-external-input and hardening plus explicit review against known attack patterns; these reach some but not most chicken-bit/undocumented-feature cases (e.g. they can force documented disablement or removal of many backdoors), yet leave a bounded remainder where the undocumented feature is unknown to the designers or introduced post-review.
Secure coding standards and peer review detect and prohibit undocumented or debug features.
Security testing in development and acceptance can uncover undocumented functionality before release.
A.8.32 governs a formal, documented process for planning/assessing/authorizing/testing/implementing changes; it does not reach or block the presence of undocumented chicken bits or features that enable unauthorized entry