CVE-2017-14728
9.8 CRITICALAn authentication bypass was found in an unknown area of the SiteOmat source code
Published: 2019-06-03 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-798
Affected products
| Vendor | Product |
|---|---|
| orpak | siteomat |
Description
An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2017-14728
- [Vendor advisory]http://www.orpak.com/allproducts/siteomat-station-controller-sw/
- [Other]http://www.securityfocus.com/bid/108167
- [Other]https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
- [Vendor advisory]http://www.orpak.com/allproducts/siteomat-station-controller-sw/
- [Other]http://www.securityfocus.com/bid/108167
- [Other]https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
Related CVEs
Same vendor
- CVE-2017-14854 — A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution (9.1 CRITICAL)
- CVE-2017-14853 — The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses ... (8.6 HIGH)
- CVE-2017-14852 — An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SS... (8.6 HIGH)
- CVE-2017-14851 — A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25 (9.8 CRITICAL)
- CVE-2017-14850 — All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to... (6.1 MEDIUM)
Same CWE
- CVE-2026-47281 — Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network (9.6 CRITICAL)
- CVE-2026-11414 — A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service
- CVE-2025-71317 — NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access (9.8 CRITICAL)
- CVE-2026-21404 — NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation (6.3 MEDIUM)
- CVE-2026-50213 — The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predi... (7.5 HIGH)