{"id":"CVE-2026-15706","state":"PUBLISHED","title":"Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS","description":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.","publishedAt":"2026-08-20T13:27:51.370Z","updatedAt":"2026-08-24T07:23:15.383Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"TR-CERT"},"assigner":"TR-CERT","products":["Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS)"],"affected":[{"vendor":"Baylan Measuring Instruments Industry and Trade Inc.","product":"Baylan Smart Meter Management Application (BMS)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.1.10.142","versionType":"custom"}]}],"references":["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15706.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15706","state":"PUBLISHED","datePublished":"2026-08-20T13:27:51.370Z","dateUpdated":"2026-08-24T07:23:15.383Z","assignerShortName":"TR-CERT","assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateReserved":"2026-07-14T07:34:41.424Z"},"containers":{"cna":{"title":"Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS","descriptions":[{"lang":"en","value":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142."}],"affected":[{"vendor":"Baylan Measuring Instruments Industry and Trade Inc.","product":"Baylan Smart Meter Management Application (BMS)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v1.1.10.142","versionType":"custom"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306 Missing authentication for critical function","type":"CWE"}]}],"providerMetadata":{"shortName":"TR-CERT","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateUpdated":"2026-08-24T07:23:15.383Z"},"datePublic":"2026-08-20T13:24:00.000Z","impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"credits":[{"lang":"en","value":"Musa Şana - Meta Cyber","type":"finder"}],"source":{"defect":["TR-26-0881"],"advisory":"TR-26-0881","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15706","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-20T15:58:41.172269Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-20T16:27:26.885Z"}}]}}}