CVE-2026-16731
Received Received - Intake

Authentication Bypass in OMICRON StationScout

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: 57995746-fc30-4a4d-94f6-a13d079c41f4

Description
OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters or injecting network traffic into the connected network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-16731
EUVD
EUVD-2026-53923

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
omicron stationscout to 3.05 (exc)
omicron stationscout 3.00.0079

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cryptographic timing side-channel flaw in OMICRON StationScout versions before 3.05. It allows unauthenticated attackers to forge authentication credentials, bypass security controls, and impersonate legitimate users. Exploitation grants full system access, enabling configuration changes and unauthorized network traffic injection.

Detection Guidance

Detecting this vulnerability requires checking the StationScout firmware version. Run 'show version' or 'get system info' on the device. If the version is below 3.05.0081, the system is vulnerable. Network monitoring tools can detect unusual authentication attempts or unauthorized configuration changes.

Impact Analysis

An attacker could gain full control over the StationScout system, modify settings, reset configurations, or inject malicious traffic into your network. This could disrupt operations, compromise sensitive data, or allow further attacks on connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face legal penalties, loss of compliance certifications, and reputational damage due to compromised systems.

Mitigation Strategies

Upgrade StationScout firmware to version 3.05.0081 or later immediately. Isolate affected devices from critical network segments until patched. Review system logs for signs of unauthorized access or configuration changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16731. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart