CVE-2023-28611

Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions

Critical · published March 23, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

🚨 A simple oversight lets anyone swipe the keys to the kingdom! In OMICRON StationGuard (1.10-2.20) and StationScout (1.30-2.20), the authorization checks are about as effective as a bouncer who takes a nap at the door. 🔥 Imagine a hotel with a front desk that doesn’t check IDs — just anyone can stroll in and access the guests' rooms without a second glance. This vulnerability lets attackers bypass intended access restrictions, much like the way a sneaky guest could wander into the staff-only floors without a keycard. If exploited, an attacker could gain unauthorized access to sensitive areas and information, potentially wreaking havoc on systems that rely on these applications. This could lead to data leaks, tampering, or even full control over critical operations—absolutely devastating!

Put simply

Imagine a hotel with a front desk that doesn’t check IDs — just anyone can stroll in and access the guests' rooms without a second glance. This vulnerability lets attackers bypass intended access restrictions, much like the way a sneaky guest could wander into the staff-only floors without a keycard. This vulnerability stems from a flaw in authorization checks within OMICRON StationGuard and StationScout, allowing unauthorized users to bypass access restrictions that should be in place.

What to do

If exploited, an attacker could gain unauthorized access to sensitive areas and information, potentially wreaking havoc on systems that rely on these applications. This could lead to data leaks, tampering, or even full control over critical operations—absolutely devastating! Immediately update to the latest versions: StationGuard 2.21 and StationScout 2.21. Review user permissions to ensure proper access controls are in place and conduct audits to spot any unauthorized access attempts. This is a must-do! You've got this! With the right updates and vigilance, you'll keep your systems secure and robust. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00645 · 50.3th percentile
Published
2023-03-23T00:00Z
EPSS history
Timeline
  • 23 MAR 00:00Z
    Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions
    cvelistv5