CVE-2025-46750: Authentication Bypass

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-12 · updated 2026-06-17
Weakness: CWE-305

Description

SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings by importing a BIOS settings file with no password set.

Affected products

Schweitzer Engineering Laboratories SEL-3350-1: before 1.3.49152.117 — fixed in 1.3.49152.117
Schweitzer Engineering Laboratories SEL-3355-2: before 2.6.49152.98 — fixed in 2.6.49152.98
Schweitzer Engineering Laboratories SEL-3360-2: before 2.6.49152.98 — fixed in 2.6.49152.98

How to fix

Upgrade to a fixed version: Schweitzer Engineering Laboratories SEL-3350-1 1.3.49152.117; Schweitzer Engineering Laboratories SEL-3355-2 2.6.49152.98; Schweitzer Engineering Laboratories SEL-3360-2 2.6.49152.98. Check the vendor advisory for mitigations.

References

https://selinc.com/products/software/latest-software-versions/

Get alerted when CVE-2025-46750 or the next vulnerability affects your stack