SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-890446934] OmniMetrix OmniView Vulnerabilities

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2016-12-15OtherOmniMetrixBill VoltmerN/ACVE-2016-5786 CVE-2016-5801 N/AN/AN/A

Source

						
							
								
#
# OmniMetrix OmniView Vulnerabilities
#


### OVERVIEW

Bill Voltmer of Elation Technologies LLC has identified vulnerabilities in OmniMetrix's OmniView web application. OmniMetrix has produced a new software version for its web interface that mitigates these vulnerabilities.
These vulnerabilities could be exploited remotely.



### AFFECTED PRODUCTS

The following OmniView versions are affected:
OmniView, Version 1.2



### IMPACT

Exploiting these vulnerabilities could compromise account credentials that may allow an attacker to control the operation of backup generators connected to the compromised account.
Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.



### BACKGROUND

OmniMetrix is a US-based company that is headquartered in Buford, Georgia.
The affected web interface, OmniView, is a data management control center that is used to monitor and control backup generators. OmniView is only accessible from OmniMetrix's web site. According to OmniMetrix, its services are deployed across several sectors including Commercial Facilities and Energy. OmniMetrix estimates that its services are primarily used in the United States with a small number of users in Europe, Asia, and South America.



### VULNERABILITY CHARACTERIZATION

# VULNERABILITY OVERVIEW

CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATIONa
The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials.
CVE-2016-5786b has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

WEAK PASSWORD REQUIREMENTSd
Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords.
CVE-2016-5801e has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)




### VULNERABILITY DETAILS

# EXPLOITABILITY

These vulnerabilities could be exploited remotely.



# EXISTENCE OF EXPLOIT

No known public exploits specifically target these vulnerabilities.



# DIFFICULTY

An attacker with low skill would be able to exploit these vulnerabilities.



### MITIGATION

OmniMetrix has deployed a new version of OmniView software that resolves the reported vulnerabilities
OmniMetrix reports that it has implemented the use of HTTPS protocol and enforces strong password requirements
When OmniMetrix's users log into the OmniMetrix web site, they will be prompted to change passwords
OmniMetrix recommends that users log into their accounts as soon as possible to change their passwords:
https://webdata.omnimetrix.net/omxphp/omxLogin.php


For additional information about the new version of OmniView, contact OmniMetrix at:
https://www.omnimetrix.net/en/support/customer-support/