Which versions of OMICRON StationScout are affected by CVE-2026-16731?

OMICRON StationScout versions before 3.05 contain a cryptographic timing side-channel vulnerability enabling complete authentication bypass for unauthenticated attackers, creating critical risk to…. A patch is available.

How to fix or mitigate CVE-2026-16731?

Within 24 hours: inventory all OMICRON StationScout deployments and identify instances running versions before 3.05; immediately restrict network access to StationScout systems to authorized engineering subnets only and enable monitoring for anomalous authentication patterns and failed access attempts. Within 7 days: implement multi-factor authentication or additional out-of-band verification for privileged configuration changes, deploy network segmentation isolating affected systems from operational networks, and establish continuous audit logging for all configuration modifications. Within 30 days: contact OMICRON to request availability timeline for version 3.05 or later; conduct controlled testing in isolated environments; develop and execute production upgrade plan aligned with change management procedures and maintenance windows.

OMICRON StationScout CVE-2026-16731

Q: What is the CVSS score of CVE-2026-16731?

CVE-2026-16731 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-53923 HIGH

Observable Timing Discrepancy (CWE-208)

2026-08-06 OMICRON

GHSA-66qm-g96m-4843

Authentication Bypass Omicron Stationscout Omicron Electronics Gmbh

8.3

CVSS 4.0 · Vendor: OMICRON

Severity by source

Vendor (OMICRON) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Network-accessible unauthenticated authentication endpoint (AV:N, PR:N); AC:H for timing precision required; S:C and I:H for traffic injection into connected network; no direct availability impact on StationScout itself.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (OMICRON).

CVSS VectorVendor: OMICRON

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 06, 2026 - 15:17 EUVD

Analysis Generated

Aug 06, 2026 - 14:22 vuln.today

CVE Published

Aug 06, 2026 - 13:14 cve.org

HIGH 8.3

DescriptionCVE.org

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters or injecting network traffic into the connected network.

AnalysisAI

Cryptographic timing side-channel in OMICRON StationScout before version 3.05 allows unauthenticated network attackers to forge valid authentication credentials, bypass authentication and authorization entirely, and impersonate legitimate clients - granting full access to system configuration and the ability to inject traffic into the connected substation network. The CVSS 4.0 vector confirms unauthenticated remote exploitability (PR:N, AV:N) with high complexity (AC:H) reflecting the statistical measurement precision timing attacks require, and scope-change indicators (SC:H/SI:H/SA:H) capture downstream risk to connected OT systems. No public exploit has been identified at time of analysis, and the CVSS 4.0 supplemental metric E:U corroborates absence of confirmed exploitation.

Technical ContextAI

CWE-208 (Observable Timing Discrepancy) describes a class of implementation flaw in which cryptographic operations - typically secret-dependent comparisons such as HMAC verification, token validation, or password matching - execute in measurably non-constant time relative to the secret being compared. By submitting repeated authentication requests and performing statistical analysis on server response latencies, an attacker can iteratively recover or reconstruct the secret material and ultimately produce credentials the server accepts as authentic. The affected product, identified by CPE cpe:2.3:a:omicron_electronics_gmbh:omicron_stationscout:*:*:*:*:*:*:*:* covering all versions before 3.05, is OMICRON StationScout - a specialized OT/ICS platform from OMICRON Electronics GmbH used in electrical substations for protection relay commissioning, testing, and network monitoring. The backend authentication mechanism lacks constant-time comparison, violating a foundational requirement of secure cryptographic design and making it measurably distinguishable across credential attempts.

RemediationAI

Vendor-released patch: version 3.05. Operators should upgrade OMICRON StationScout to version 3.05 or later as the primary remediation; details and release artifacts are available from OMICRON Electronics GmbH at https://www.omicronenergy.com/.well-known/csaf/osa-21.json. Where immediate patching is operationally infeasible, restrict network access to the StationScout management interface to explicitly trusted engineering workstations and management VLANs using perimeter firewall rules or network ACLs - this reduces but does not eliminate risk, as an attacker already within the trusted segment retains exploitation capability. Placing StationScout on an isolated management VLAN with no routing to untrusted networks is a stronger compensating control but may disrupt workflows that depend on broader network reachability. Monitoring authentication service logs for high volumes of repeated connection attempts with varying credential patterns may provide early detection of an in-progress timing attack. Compensating controls should be treated as temporary measures only - the root cause is in the authentication implementation and requires the vendor patch to resolve.