Baylan BMS CVE-2026-15706

No special authentication or interaction conditions per the CVSS vector (AV:N/AC:L/PR:N/UI:N) - a remote attacker who can reach the BMS management interface can invoke the critical function without credentials. The primary limiting factor is network reachability: exploitation requires the vulnerable BMS management endpoint to be accessible to the attacker, and BMS running on the fixed version v1.1.10.142 or later is not affected. Deployments where BMS is isolated on a segmented OT/management network or behind a VPN significantly constrain who can reach the vulnerable function, even though the flaw itself imposes no auth or configuration prerequisite.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the worst-case profile for exploitability: network vector, low complexity, no privileges, and no user interaction, with total impact on all three security properties - an authentication bypass that is trivially automatable if the management interface is internet-exposed. However, no EPSS score, SSVC decision, KEV entry, or POC was supplied, so the quantitative exploitation-probability signal is simply absent rather than low; the 9.8 reflects potential severity, not confirmed field activity. The genuine risk hinges on exposure: BMS is critical infrastructure tooling (smart-meter/utility management), so an exposed instance is a high-priority target, but these systems are frequently deployed on segmented OT/management networks that materially reduce reachability. Net assessment: treat as a high-priority patch where BMS is deployed and verify whether the management interface is network-reachable, while noting the exploitation-likelihood data (EPSS/KEV/POC) is missing and cannot be presented as either high or low with confidence.

An attacker who can reach the BMS management interface over the network sends a request directly to the unauthenticated critical function, bypassing login entirely, and gains administrative control over smart-meter management operations - reading, altering, or disrupting metering data and device configuration. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special conditions are needed, making the request straightforward to script once the endpoint is located. No public POC has been identified, so an attacker would need to independently discover the exposed function.