OmniMetrix created a new software version for its web interface that mitigates vulnerabilities in its OmniView web application, according to a report with ICS-CERT.
These vulnerabilities, discovered by Bill Voltmer of Elation Technologies LLC, are remotely exploitable.
RELATED STORIES
Fatek Automation PLC Vulnerability
Visonic PowerLink2 Vulnerabilities
Moxa Patches DACenter Holes
Delta Electronics Fixes Software Holes
OmniView, Version 1.2 suffers from the issue.
Exploiting these vulnerabilities could compromise account credentials that may allow an attacker to control the operation of backup generators connected to the compromised account.
OmniMetrix is a U.S.-based company headquartered in Buford, Georgia.
The affected web interface, OmniView, is a data management control center used to monitor and control backup generators. OmniView is only accessible from OmniMetrix’s web site. OmniMetrix said its services see action across several sectors including commercial facilities and energy. OmniMetrix said its services see use mainly in the United States with a small number of users in Europe, Asia, and South America.
The OmniView web application transmits credentials with the HTTP protocol, which could end up sniffed by an attacker that may result in the compromise of account credentials.
CVE-2016-5786 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.
In addition, there are insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords.
CVE-2016-5801 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.
No known public exploits specifically target these vulnerabilities. However, an attacker with low skill would be able to exploit these vulnerabilities.
OmniMetrix deployed a new version of OmniView software that resolves the reported vulnerabilities. OmniMetrix reports that it has implemented the use of HTTPS protocol and enforces strong password requirements. When OmniMetrix’s users log into the OmniMetrix web site, they will be prompted to change passwords. OmniMetrix recommends users log into their accounts as soon as possible to change their passwords.
For additional information about the new version of OmniView, contact OmniMetrix.