CVE-2023-2265 is a clickjacking vulnerability (CWE-1021, improper restriction of rendered UI layers or frames) in the web interface of SEL's SEL-411L, a line current differential and distance protection relay: an unauthenticated attacker can embed that web interface inside an invisible frame on a malicious page to trick an already-authenticated operator into clicking hidden controls, and NVD's Primary rating puts the impact at 6.1 (medium) on CVSS v3.1.
Vulnerability summary
6.1
Medium
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2023-11-30
Published
Vulnerability ID: CVE-2023-2265 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Schweitzer Engineering Laboratories SEL-411L line current differential and distance protection relay | cpe:2.3:o:selinc:sel-411l_firmware:*:*:*:*:*:*:*:* | SEL-411L firmware revisions R118 (V0-V3) through R129 (V0); see SEL's Instruction Manual Appendix A dated 2023-08-30 for the exact fixed revision per device, per NVD and SEL |
What does this mean for affected devices?
CVE-2023-2265 (CWE-1021, Improper Restriction of Rendered UI Layers or Frames) affects the SEL-411L, a Schweitzer Engineering Laboratories relay that combines line current differential and distance protection for transmission lines.
NVD's description states: "An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform clickjacking based attacks against an authenticated and authorized user" (NVD).
NVD records a Primary CVSS v3.1 score of 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — network-reachable, low attack complexity, no privileges required but user interaction required (the victim must click within the hidden frame), with Scope:Changed reflecting that the attack's effect crosses from the embedding malicious page into the relay's web session. SEL's own PSIRT submission to NVD carries a lower Secondary score of 4.3 with Scope:Unchanged (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) — both ratings are published on the same NVD record (NVD).
The flaw is tracked in CISA's ICS advisory ICSA-23-341-02 ("Schweitzer Engineering Laboratories SEL-411L"), which lists the affected firmware revisions as R118 (V0-V3), R119 (V0-V4), R120 (V0-V5), R121 (V0-V2), R122 (V0-V2), R123 (V0-V2), R124 (V0-V2), R125 (V0-V2), R126 (V0-V3), R127 (V0-V1), R128 (V0) and R129 (V0), and states that successful exploitation "could expose authorized users to clickjacking attacks" (CISA ICSA-23-341-02).
SEL publishes its own vulnerability notifications, including this one, through its external security-reports page, and directs customers to "product Instruction Manual Appendix A dated 20230830 for more details" on the exact fixed revision for their device (SEL — Security Notifications: External Reports).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.39% (33.3th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Operators running an affected SEL-411L revision should consult SEL's Instruction Manual Appendix A for the fixed revision and, in the meantime, avoid browsing untrusted sites from a session authenticated to the relay's web interface.
Evidence
- An Improper Restriction of Rendered UI Layers or Frames in the SEL-411L could allow an unauthenticated attacker to perform clickjacking-based attacks against an authenticated and authorized user. — NVD
- NVD Primary CVSS v3.1 score 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; SEL's own Secondary submission scores it 4.3 with Scope:Unchanged, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. — NVD
- CISA ICS advisory ICSA-23-341-02 lists affected SEL-411L firmware revisions R118 through R129 and states exploitation could expose authorized users to clickjacking attacks; affects the energy sector with worldwide deployment. — CISA ICSA-23-341-02
- SEL's security-notifications page covers this vulnerability and directs customers to the product Instruction Manual Appendix A dated 2023-08-30 for details on the fixed revision. — SEL — Security Notifications: External Reports
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.39% (33.3th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What does "clickjacking" mean for the SEL-411L's web interface?
An attacker can embed the relay's web HMI inside an invisible frame on a malicious page, so a logged-in operator who clicks what looks like a harmless page element is actually clicking a hidden control inside their own authenticated relay session (per NVD).
Does exploiting this flaw require the attacker to be authenticated?
No — NVD's vector shows no privileges required for the attacker (PR:N), but it does require user interaction (UI:R): an already-authenticated, authorized operator has to click within the hidden frame for the attack to succeed (per NVD).
Why do NVD and SEL list two different CVSS scores for the same CVE?
NVD's Primary rating (6.1) marks Scope:Changed, reflecting that the clickjacking effect crosses from the attacker's embedding page into the relay's web session, while SEL's own Secondary submission (4.3) marks Scope:Unchanged; NVD publishes both on the same record rather than picking one (per NVD).
Which SEL-411L firmware revisions are affected?
CISA's advisory lists revisions R118 through R129 across their respective sub-versions (for example R118 V0-V3 and R129 V0); operators should check SEL's product Instruction Manual Appendix A dated 2023-08-30 for the fixed revision for their specific device (per CISA ICSA-23-341-02, SEL).