CVE-2017-14728

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.orpak.com/allproducts/siteomat-station-controller-sw/Product, Vendor Advisory
http://www.securityfocus.com/bid/108167Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01Third Party Advisory, US Government Resource
http://www.orpak.com/allproducts/siteomat-station-controller-sw/Product, Vendor Advisory
http://www.securityfocus.com/bid/108167Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01Third Party Advisory, US Government Resource

Timeline

Published: Jun 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-147297.8The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not e CVE-2017-14737.5IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms tha CVE-2017-147307.8The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable dire CVE-2017-147316.5ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and appl CVE-2017-147336.5ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to c CVE-2017-147348.8The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and app CVE-2017-147356.1OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.CVE-2017-147375.5A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local CVE-2017-147389.8FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield CVE-2017-147397.5The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which a CVE-2017-14745.3IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorize CVE-2017-147404.8Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the