Omicron Stationguard
Monthly
Authentication bypass in OMICRON StationGuard before version 4.10 enables unauthenticated remote attackers to forge valid credentials by exploiting a cryptographic timing side-channel in the backend authentication mechanism (CWE-208). Successful exploitation grants full administrative control over the substation monitoring system configuration, including the ability to modify, reset, or alter system parameters - a high-consequence outcome in operational technology environments where configuration integrity is safety-relevant. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-privilege attack surface warrants priority patching in OT network segments.
Improper input validation in OMICRON StationGuard 4.00 allows an adjacent network attacker to crash the IEC 61850 Sampled Values processing component by sending a specially crafted SV frame. The disruption is self-healing - the process restarts automatically and the failure is immediately surfaced to operators - leaving overall system availability and all other monitored traffic types unaffected. No public exploit code exists and this vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 1.3 reflects the accurately bounded, minimal real-world impact.
Authentication bypass in OMICRON StationGuard before version 4.10 enables unauthenticated remote attackers to forge valid credentials by exploiting a cryptographic timing side-channel in the backend authentication mechanism (CWE-208). Successful exploitation grants full administrative control over the substation monitoring system configuration, including the ability to modify, reset, or alter system parameters - a high-consequence outcome in operational technology environments where configuration integrity is safety-relevant. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-privilege attack surface warrants priority patching in OT network segments.
Improper input validation in OMICRON StationGuard 4.00 allows an adjacent network attacker to crash the IEC 61850 Sampled Values processing component by sending a specially crafted SV frame. The disruption is self-healing - the process restarts automatically and the failure is immediately surfaced to operators - leaving overall system availability and all other monitored traffic types unaffected. No public exploit code exists and this vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 1.3 reflects the accurately bounded, minimal real-world impact.