Is CVE-2023-31166 actively exploited?

No active exploitation of CVE-2023-31166 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-31166 be exploited remotely?

Yes. CVE-2023-31166 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-31166?

CVE-2023-31166 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2023-31166

MEDIUM

CVE-2023-31166

CWE-22Published: May 10, 2023· Updated: Jun 17, 2026

4.3

CVSS v3.1

Official Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system.

See SEL Service Bulletin dated 2022-11-15 for more details.

NVD Source

Technical Analysis

CVE-2023-31166 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Vendors & Products

selinc20 product(s)

sel-2241 rtac module firmwaresel-2241 rtac modulesel-3350 firmwaresel-3350sel-3505 firmwaresel-3505sel-3505-3 firmwaresel-3505-3sel-3530 firmwaresel-3530sel-3530-4 firmwaresel-3530-4+8

Source: NVD CPE · 20 total CPE entries