CVE-2026-16731 describes a cryptographic timing side-channel vulnerability (CWE-208) in OMICRON StationScout's backend authentication mechanism prior to version 3.05. The timing discrepancy can be observed by an attacker to forge valid authentication credentials without prior authorization. This allows bypassing authentication and authorization controls, leading to impersonation of legitimate clients. The attacker can gain full control over system configuration, including modifying, resetting, or altering system parameters and injecting network traffic into connected networks.

An unauthenticated attacker exploiting this vulnerability can gain full access to the affected system's configuration. This includes the ability to modify or reset system parameters and inject malicious network traffic, potentially compromising the integrity and security of the connected network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.