CVE-2017-14728

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.

• CWE-798
• CWE-798

• http://www.orpak.com/allproducts/siteomat-station-controller-sw/Product, Vendor Advisory
• http://www.securityfocus.com/bid/108167Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01Third Party Advisory, US Government Resource
• http://www.orpak.com/allproducts/siteomat-station-controller-sw/Product, Vendor Advisory
• http://www.securityfocus.com/bid/108167Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01Third Party Advisory, US Government Resource

Published

Jun 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14722Before version 4.8.2, WordPress allowed a Directory Traversa…
• CVE-2017-14723Before version 4.8.2, WordPress mishandled % characters and …
• CVE-2017-14724Before version 4.8.2, WordPress was vulnerable to cross-site…
• CVE-2017-14725Before version 4.8.2, WordPress was susceptible to an open r…
• CVE-2017-14726Before version 4.8.2, WordPress was vulnerable to a cross-si…
• CVE-2017-14727logger.c in the logger plugin in WeeChat before 1.9.1 allows…
• CVE-2017-14729The *_get_synthetic_symtab functions in the Binary File Desc…
• CVE-2017-1473IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 …
• CVE-2017-14730The init script in the Gentoo app-admin/logstash-bin package…
• CVE-2017-14731ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows rem…
• CVE-2017-14733ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishan…
• CVE-2017-14734The build_msps function in libbpg.c in libbpg 0.9.7 allows r…