CVE-2026-15706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15706", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-07-14T07:34:41.424Z", "datePublished": "2026-08-20T13:27:51.370Z", "dateUpdated": "2026-08-24T07:23:15.383Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-24T07:23:15.383Z"}, "title": "Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS", "datePublic": "2026-08-20T13:24:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "Baylan Measuring Instruments Industry and Trade Inc.", "product": "Baylan Smart Meter Management Application (BMS)", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.1.10.142", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.<p>This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Musa \u015eana - Meta Cyber", "type": "finder"}], "source": {"defect": ["TR-26-0881"], "advisory": "TR-26-0881", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T15:58:41.172269Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T16:27:26.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T15:58:41.172269Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T16:18:53.054Z"}}], "cna": {"title": "Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS", "source": {"defect": ["TR-26-0881"], "advisory": "TR-26-0881", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Musa \u015eana - Meta Cyber"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Baylan Measuring Instruments Industry and Trade Inc.", "product": "Baylan Smart Meter Management Application (BMS)", "versions": [{"status": "affected", "version": "0", "lessThan": "v1.1.10.142", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-20T13:24:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.", "supportingMedia": [{"type": "text/html", "value": "Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.<p>This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-24T07:23:15.383Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15706", "state": "PUBLISHED", "dateUpdated": "2026-08-24T07:23:15.383Z", "dateReserved": "2026-07-14T07:34:41.424Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-08-20T13:27:51.370Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Baylan Smart Meter Management Application (BMS)", "vendor": "Baylan Measuring Instruments Industry and Trade Inc.", "versions": [{"lessThan": "v1.1.10.142", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142."}, {"lang": "es", "value": "Vulnerabilidad de ausencia de autenticaci\u00f3n para funci\u00f3n cr\u00edtica en la Aplicaci\u00f3n de Gesti\u00f3n de Medidores Inteligentes Baylan (BMS) de Baylan Measuring Instruments Industry and Trade Inc. permite la omisi\u00f3n de autenticaci\u00f3n.\n\nEste problema afecta a la Aplicaci\u00f3n de Gesti\u00f3n de Medidores Inteligentes Baylan (BMS): anterior a la v1.1.10.142."}], "id": "CVE-2026-15706", "lastModified": "2026-10-27T10:10:00.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15706", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T15:58:41.172269Z", "version": "2.0.3"}}]}, "published": "2026-08-20T14:17:09.617", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v1.1.10.142)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Baylan Smart Meter Management Application (BMS)", "source": "cna", "vendor": "Baylan Measuring Instruments Industry and Trade Inc."}, "product": "baylan_smart_meter_management_application_(bms)", "vendor": "baylan_measuring_instruments_industry_and_trade_inc."}], "created": "2026-08-20T20:00:05.767354+00:00", "updated": "2026-08-21T12:09:22.733323+00:00", "vendors": ["baylan_measuring_instruments_industry_and_trade_inc.", "baylan_measuring_instruments_industry_and_trade_inc.$PRODUCT$baylan_smart_meter_management_application_(bms)"]}