CVE-2017-7928

CRITICAL

SEL-3620 and SEL-3622 Security Gateway R202-R204 - Improper Access Control via NAT Port Forwarding

Title source: llm

Description

An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may allow for unauthorized communications to downstream devices.

References (2)

Core 2

Core References

Mitigation, Third Party Advisory, US Government Resource x_refsource_misc

https://ics-cert.us-cert.gov/advisories/ICSA-17-192-06

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/99536

Scores

CVSS v3 10.0

EPSS 0.0227

EPSS Percentile 80.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-284

Status published

Products (13)

n/a/Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622

selinc/sel-3620_firmware r202

selinc/sel-3620_firmware r203

selinc/sel-3620_firmware r203-v

selinc/sel-3620_firmware r203-v1

selinc/sel-3620_firmware r204

selinc/sel-3620_firmware r204-v1

selinc/sel-3622_firmware r202

selinc/sel-3622_firmware r203

selinc/sel-3622_firmware r203-v

... and 3 more

Published Aug 07, 2017

Tracked Since Feb 18, 2026