CVE-2026-16315
OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U
- EPSS probability
- 0.26%
- CWE
- CWE-208
- Published
- 2026-08-06
- Last modified
- 2026-08-06
Affected products
- OMICRON electronics GmbH OMICRON StationGuard
Weakness type
Related vulnerabilities
- CVE-2026-87737 — An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing...
- CVE-2026-16037 — Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
- CVE-2026-81159 — Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
- CVE-2026-84308 — phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
- CVE-2026-82449 — Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
- CVE-2026-55785 — free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
- CVE-2026-78500 — Dimension Blind SSRF via Database Test Connection Feature
- CVE-2026-80199 — Kimai before 2.54.0 Username Enumeration via Timing Oracle