CVE-2016-5786 Omnimetrix CVE debrief

Who should care

Organizations using OmniMetrix OmniView 1.2, especially administrators responsible for web application access, network monitoring, and credential hygiene. This is most important where the interface may be reachable across shared, unmanaged, or otherwise monitorable networks.

Technical summary

The core flaw is cleartext credential transmission over HTTP in OmniView 1.2. Because the credentials are not protected in transit, they can be intercepted by a network observer. The NVD weakness classification is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Defensive priority

High. The issue directly exposes authentication material in transit and can lead to account compromise without requiring local access or user interaction, according to the published CVSS vector.

Recommended defensive actions

• Review whether OmniMetrix OmniView 1.2 is still in use and whether access to the web application is exposed beyond a trusted management network.
• Move access to encrypted transport where possible; do not allow credentials to be sent over plain HTTP.
• Restrict network paths to the application so only trusted administrative systems can reach it.
• Rotate any credentials that may have been transmitted over HTTP.
• Check the vendor and government advisory references for any product-specific mitigation guidance.

Evidence notes

All findings in this debrief are drawn from the supplied NVD record and its linked references. The source data states that OmniView 1.2 transmits credentials with the HTTP protocol and that this could be sniffed by an attacker, resulting in compromise of account credentials. NVD also provides the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and CWE-200 classification. Reference links include CVE.org, NVD, a SecurityFocus entry, and an ICS-CERT advisory.

Official resources