Baylan Smart Meter Management Application Bms
Monthly
Authentication bypass in Baylan Smart Meter Management Application (BMS) before v1.1.10.142 lets remote unauthenticated attackers reach a critical function that lacks any authentication check (CWE-306), granting full control over smart-meter management operations. The flaw was reported by Turkey's national CSIRT (TR-CERT/USOM) and carries a CVSS 9.8, reflecting network-reachable, no-privilege access with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Baylan Smart Meter Management Application (BMS) before v1.1.10.142 lets remote unauthenticated attackers reach a critical function that lacks any authentication check (CWE-306), granting full control over smart-meter management operations. The flaw was reported by Turkey's national CSIRT (TR-CERT/USOM) and carries a CVSS 9.8, reflecting network-reachable, no-privilege access with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.