{"id":"CVE-2026-15706","aliases":["EUVD-2026-63349","GHSA-v77m-pgr8-9w4g"],"status":"published","title":"Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS","description":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00643,"percentile":0.51165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-306"],"published":"2026-08-20T13:27:51Z","modified":"2026-10-27T10:10:00Z","exploits":[{"source":"pocgithub","id":"musana/CVE-2026-15706","title":"musana/CVE-2026-15706","date":"2026-07-14","url":"https://github.com/musana/CVE-2026-15706"}],"products":[{"vendor":"baylan measuring instruments industry and trade inc.","product":"baylan smart meter management application (bms)"}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881","tags":["government-resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15706"},{"url":"https://github.com/advisories/GHSA-v77m-pgr8-9w4g"}],"sources":{"cve":[{"id":"CVE-2026-15706","title":"Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS","description":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.","status":"published","published":"2026-08-20T13:27:51.37Z","modified":"2026-08-24T07:23:15.383Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-63349","description":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.","status":"published","published":"2026-08-20T13:27:51Z","modified":"2026-08-24T07:23:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:35.768217Z"}],"ghsa":[{"id":"GHSA-v77m-pgr8-9w4g","title":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments...","description":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.","status":"published","published":"2026-08-20T15:34:17Z","modified":"2026-08-20T15:34:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:10:46.520021Z"}],"nvd":[{"id":"CVE-2026-15706","description":"Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.\n\nThis issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.","status":"published","published":"2026-08-20T14:17:09.617Z","modified":"2026-10-27T10:10:00.24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:40.302911Z"}]}}