Description
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.

This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
Published: 2026-08-20
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a missing authentication flaw that allows unauthenticated users to access a critical management API in the Baylan Smart Meter Management Application. The flaw enables an attacker to bypass authentication checks and execute privileged operations via the API, representing a severe authorization weakness (CWE-306).

Affected Systems

Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) before version 1.1.10.142 is affected. Users of earlier versions are at risk if the management API is exposed to untrusted networks.

Risk and Exploitability

The CVSS score of 9.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated, remote request to the exposed API, assuming the system is reachable over a network. An attacker could gain unauthorized control over meter management functions without needing any credentials.

Generated by OpenCVE AI on August 20, 2026 at 19:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Baylan Smart Meter Management Application to version 1.1.10.142 or later, which resolves the authentication bypass.
  • If upgrading immediately is not feasible, restrict network access to the management API by firewall or change the interface to be only accessible from a trusted subnet.
  • Apply any vendor‑issued configuration recommendations that enforce authentication on the API endpoints, such as requiring TLS or client certificates.

Generated by OpenCVE AI on August 20, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Description Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
Title Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-08-20T16:27:26.885Z

Reserved: 2026-07-14T07:34:41.424Z

Link: CVE-2026-15706

cve-icon Vulnrichment

Updated: 2026-08-20T16:18:53.054Z

cve-icon NVD

Status : Received

Published: 2026-08-20T14:17:09.617

Modified: 2026-08-20T17:17:21.307

Link: CVE-2026-15706

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:00:05Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function