A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) co…
A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service. See the ACSELERATOR RTAC SEL-5033 Software instruction manual date code 20210915 for more details.
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
https://cwe.mitre.org/data/definitions/300.html →Open in CWE collection →This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
https://capec.mitre.org/data/definitions/57.html →Open in CAPEC collection →https://capec.mitre.org/data/definitions/94.html →Open in CAPEC collection →
An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.
https://capec.mitre.org/data/definitions/466.html →Open in CAPEC collection →An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.
https://capec.mitre.org/data/definitions/589.html →Open in CAPEC collection →An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.
https://capec.mitre.org/data/definitions/590.html →Open in CAPEC collection →In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and changed by software). Once the attacker is able to associate a MAC address with a particular user or set of users (for example, when attending a public event), the attacker can then scan for that MAC address to track that user in the future.
https://capec.mitre.org/data/definitions/612.html →Open in CAPEC collection →In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retransmission device) as well as by clients that are accessing the network (e.g., the handset/mobile device). Once the attacker is able to associate an SSID with a particular user or set of users (for example, when attending a public event), the attacker can then scan for this SSID to track that user in the future.
https://capec.mitre.org/data/definitions/613.html →Open in CAPEC collection →Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversary-in-the-middle" (CAPEC-94) for all communications.
https://capec.mitre.org/data/definitions/615.html →Open in CAPEC collection →https://capec.mitre.org/data/definitions/662.html →Open in CAPEC collection →
| Product | Vendor | Status |
|---|---|---|
| sel-2241_rtac_module_firmware | * | Tracked |
| sel-3350_firmware | * | Tracked |
| sel-3505-3_firmware | * | Tracked |
| sel-3505_firmware | * | Tracked |
| sel-3530-4_firmware | * | Tracked |
| sel-3530_firmware | * | Tracked |
| sel-3532_firmware | * | Tracked |
| sel-3555_firmware | * | Tracked |
| sel-3560e_firmware | * | Tracked |
| sel-3560s_firmware | * | Tracked |