EUVD-2026-53921
GHSA-5qgx-gc63-5xc9
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges, AC:H for timing attack precision requirements; scope changed because downstream substation IED configuration is impacted; no availability impact per VA:N in vendor-provided CVSS 4.0 data.
Primary rating from Vendor (OMICRON).
CVSS VectorVendor: OMICRON
Lifecycle Timeline
3DescriptionCVE.org
OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters.
AnalysisAI
Authentication bypass in OMICRON StationGuard before version 4.10 enables unauthenticated remote attackers to forge valid credentials by exploiting a cryptographic timing side-channel in the backend authentication mechanism (CWE-208). Successful exploitation grants full administrative control over the substation monitoring system configuration, including the ability to modify, reset, or alter system parameters - a high-consequence outcome in operational technology environments where configuration integrity is safety-relevant. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-privilege attack surface warrants priority patching in OT network segments.
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) describes a class of cryptographic implementation flaws where secret-dependent comparisons - such as HMAC validation, token verification, or credential matching - execute in non-constant time. This leaks information about the secret value through statistically measurable differences in response latency. OMICRON StationGuard (CPE: cpe:2.3:a:omicron_electronics_gmbh:omicron_stationguard) is a cybersecurity monitoring platform for electric power substations, typically deployed to monitor IEC 61850 traffic and protection relay communications. The backend authentication mechanism fails to use constant-time comparison primitives, allowing an attacker to submit repeated authentication attempts while measuring response times, statistically infer valid credential components byte-by-byte, and ultimately construct a forged but cryptographically valid authentication token - bypassing both authentication and downstream authorization checks.
RemediationAI
Upgrade OMICRON StationGuard to version 4.10 or later, which resolves the timing side-channel in the backend authentication mechanism per the vendor advisory at https://www.omicronenergy.com/.well-known/csaf/osa-21.json. If immediate patching is not operationally feasible, apply the following compensating controls: restrict network access to the StationGuard backend management interface using firewall rules or VPN enforcement, limiting reachability to explicitly allowlisted management workstation IPs - this raises the bar for an attacker to execute timing measurements. Additionally, enable authentication attempt logging and configure alerting for anomalous volumes of authentication requests, which may surface timing-analysis activity. Note that network segmentation reduces attack feasibility but does not eliminate the vulnerability; a threat actor who has already obtained OT network access can still exploit the flaw. Only the vendor-released patch for version 4.10 resolves the root cause.
More in Omicron Stationguard
View allSame weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today