Description Summary:
Hirschmann HiOS Switch Platform version 09 contains a high-severity vulnerability that affects the security of the network switching infrastructure.

Executive Summary:
Hirschmann HiOS Switch Platform version 09 is affected by a critical vulnerability that may allow attackers to compromise industrial network hardware.

Vulnerability Details

CVE-ID: CVE-2025-15620

Affected Software: Hirschmann HiOS Switch Platform

Affected Versions: HiOS Switch Platform versions 09

Vulnerability: This vulnerability resides in the HiOS platform firmware. While specific technical details are limited, the CVSS score of 8.6 suggests a flaw that could allow for remote code execution or unauthorized configuration changes by an attacker.

Business Impact

Exploitation of network switching infrastructure can lead to complete network interception, data exfiltration, or the disruption of industrial control systems. The CVSS score of 8.6 reflects the high risk to critical infrastructure, where a compromise could lead to operational downtime and physical safety concerns in industrial environments.

Remediation Plan

Immediate Action: Update the HiOS firmware to the latest secure version released by Hirschmann to address the vulnerability in version 09.

Proactive Monitoring: Monitor network management traffic (SNMP, SSH, HTTP) for unauthorized login attempts or configuration changes on switch hardware.

Compensating Controls: Isolate the switch management interface on a dedicated, non-routable VLAN and use multi-factor authentication for all administrative access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Because this affects industrial networking equipment, the risk to operational technology (OT) environments is particularly high.

Analyst Recommendation

Given the critical role of switches in network architecture, this vulnerability must be addressed with the highest urgency. Administrators should apply the firmware update immediately to prevent potential unauthorized access to the network core.

Description Summary:
An authentication bypass in the Hirschmann HiEOS HTTP(S) management module allows unauthenticated attackers to gain administrative access and modify device firmware.

Executive Summary:
A critical authentication bypass in Hirschmann HiEOS industrial switches allows unauthenticated remote attackers to gain full administrative control, potentially disrupting industrial control systems.

Vulnerability Details

CVE-ID: CVE-2024-14034

Affected Software: Hirschmann HiEOS

Affected Versions: Versions prior to 01.1.00

Vulnerability: The HTTP(S) management module fails to properly validate authentication for specially crafted requests. This allows an unauthenticated remote attacker to bypass login requirements, gain administrative privileges, and perform high-impact actions like firmware modification or configuration tampering.

Business Impact

In an Industrial Control System (ICS) environment, unauthorized access to networking hardware can lead to the disruption of critical processes or physical damage. The CVSS score of 9.8 reflects the extreme risk, as attackers could modify network traffic or create persistent backdoors via malicious firmware updates.

Remediation Plan

Immediate Action: Update Hirschmann HiEOS devices to version 01.1.00 or later immediately to resolve the authentication handling logic error.

Proactive Monitoring: Monitor network traffic for unusual HTTP(S) management traffic directed at industrial switches and review device logs for unauthorized configuration changes or firmware update events.

Compensating Controls: Disable the web-based management interface if not required, or isolate the management network from the public internet and general corporate LAN using a strict firewall policy.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation. This is a late-disclosure vulnerability, meaning the window for attackers to have developed private exploits may be larger than usual.

Analyst Recommendation

This vulnerability is particularly dangerous due to its location in industrial networking equipment. Administrators should prioritize patching these devices during the next available maintenance window or immediately if the devices are reachable from untrusted networks to prevent operational technology (OT) disruptions.

Description Summary:
A heap overflow vulnerability in Hirschmann HiLCOS web interfaces allows unauthenticated remote attackers to trigger a denial-of-service condition via crafted requests.

Executive Summary:
Unauthenticated remote attackers can disable Hirschmann Industrial IT products via a heap overflow vulnerability in the HiLCOS web interface.

Vulnerability Details

CVE-ID: CVE-2024-14033

Affected Software: Hirschmann Industrial IT products (BAT-R, BAT-F, BAT450-F, BAT867-R, BAT867-F, WLC, BAT Controller Virtual)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A heap overflow vulnerability exists in the HiLCOS web interface. This flaw allows an unauthenticated remote attacker to send specially crafted requests to the device, leading to a system crash or a denial-of-service (DoS) condition.

Business Impact

The ability for an unauthenticated attacker to remotely disable industrial networking equipment can lead to immediate operational shutdowns and loss of visibility into critical processes. The CVSS score of 7.5 reflects a High severity, primarily due to the impact on system availability and the lack of authentication required for exploitation.

Remediation Plan

Immediate Action: Apply the vendor security updates immediately to all affected BAT and WLC devices.

Proactive Monitoring: Monitor network traffic for unusual or malformed HTTP requests directed at the management interfaces of Hirschmann devices.

Compensating Controls: Disable the web management interface if it is not required, or restrict access to the interface using firewall rules that only allow trusted administrative hosts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the unauthenticated nature of the attack makes it a high-priority target for disruption-oriented actors.

Analyst Recommendation

This vulnerability should be addressed with high urgency due to the unauthenticated remote attack vector. In industrial settings, availability is often the most critical security pillar. Patching affected Hirschmann devices immediately is essential to prevent potential malicious actors from causing widespread operational downtime.

Description Summary:
Hirschmann HiSecOS web server version 05 is vulnerable to a high-severity security flaw that could compromise the integrity of the management interface.

Executive Summary:
A high-severity vulnerability in Hirschmann HiSecOS web server version 05 could allow attackers to gain unauthorized control over industrial networking equipment.

Vulnerability Details

CVE-ID: CVE-2023-7343

Affected Software: Hirschmann HiSecOS Web Server

Affected Versions: 05

Vulnerability: This vulnerability exists in the HiSecOS web server version 05. With a CVSS score of 7.8, the flaw likely involves improper authentication or session management, potentially allowing an attacker to escalate privileges or perform unauthorized configuration changes.

Business Impact

A successful exploit could allow an attacker to alter network traffic flow or disable security features within an industrial network. The CVSS score of 7.8 places this in the High severity range, emphasizing the risk of unauthorized access to critical infrastructure management systems and the potential for subsequent operational disruption.

Remediation Plan

Immediate Action: Update Hirschmann HiSecOS to the latest version to mitigate this vulnerability.

Proactive Monitoring: Implement logging for all administrative actions within the HiSecOS interface and set up alerts for any failed login attempts or unauthorized configuration changes.

Compensating Controls: Use a Web Application Firewall (WAF) to filter incoming traffic to the management interface and restrict access to specific, authorized IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. This late disclosure suggests that while the flaw is older, it remains a relevant threat to unpatched systems.

Analyst Recommendation

Organizations using Hirschmann HiSecOS version 05 should apply the necessary patches immediately. While the CVSS score is slightly lower than other recent vulnerabilities, a score of 7.8 still represents a significant risk to industrial operations. Ensuring the management interface is secure is paramount to maintaining overall network stability.

Description Summary:
The Hirschmann HiSecOS web server version 03 contains a high-severity vulnerability that could allow for unauthorized access or remote code execution.

Executive Summary:
Hirschmann HiSecOS web server version 03 is affected by a critical vulnerability that poses a significant risk to industrial network control and data integrity.

Vulnerability Details

CVE-ID: CVE-2023-7342

Affected Software: Hirschmann HiSecOS Web Server

Affected Versions: 03

Vulnerability: This vulnerability affects the web server component of HiSecOS version 03. Given the CVSS score of 8.8, the flaw likely allows an unauthenticated or low-privileged attacker to execute arbitrary commands or access sensitive administrative functions.

Business Impact

In industrial environments, a compromise of the HiSecOS web server can lead to the manipulation of network configurations, potentially disrupting critical infrastructure operations. The CVSS score of 8.8 indicates a High severity, where the impact could include process downtime, safety risks, and significant financial loss due to operational interruptions.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates for HiSecOS immediately.

Proactive Monitoring: Review web server access logs for unusual HTTP requests or attempts to access hidden directories and configuration files.

Compensating Controls: Isolate the management network from the production network and use a VPN or secure gateway for all administrative access to the HiSecOS web interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure, which often means that patches have been available but may not have been widely applied.

Analyst Recommendation

Due to the critical role Hirschmann products play in industrial automation and control systems, this vulnerability must be remediated immediately. The high CVSS score underscores the potential for severe operational impact. Organizations should prioritize patching these systems during the next available maintenance window or sooner if possible.

Description Summary:
A vulnerability in Hirschmann Industrial HiVision allows local attackers to execute arbitrary binaries via untrusted search path hijacking.

Executive Summary:
A local path traversal vulnerability in Belden Hirschmann Industrial HiVision allows attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2022-4987

Affected Software: Belden Hirschmann Industrial HiVision

Affected Versions: 0 through 08.1.03

Vulnerability: This flaw involves an untrusted search path (CWE-426) where insufficient path sanitization allows a local, authenticated attacker to place malicious binaries in the execution path of configured external applications.

Business Impact

Successful exploitation allows a local attacker to execute arbitrary code, potentially leading to full system compromise or privilege escalation. With a CVSS score of 7.3, this represents a significant risk to industrial control environments, as the integrity and availability of the affected management software are critical to operational continuity.

Remediation Plan

Immediate Action: Update to Hirschmann Industrial HiVision version 08.1.04, 08.2.00, or later to resolve the search path vulnerability.

Proactive Monitoring: Audit system logs for unexpected execution of binaries or unauthorized changes to file paths configured for external applications.

Compensating Controls: Restrict local system access to authorized personnel and ensure that directories used for external application configurations have strictly enforced access control lists.

Exploitation Status

Public Exploit Available: exploit_available (false)

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous in environments where users have the ability to configure external application paths, as it requires only local access to trigger the hijacked execution flow.

Analyst Recommendation

The vulnerability poses a substantial risk to systems running Hirschmann Industrial HiVision by enabling local code execution. Organizations should prioritize updating their software to the fixed versions specified by Belden to eliminate the insecure search path. Until updates are deployed, strict adherence to the principle of least privilege for local system users is essential to prevent unauthorized binary placement.

Description Summary:
A high-severity vulnerability has been identified in Hirschmann EagleSDV version 05, potentially impacting industrial network security.

Executive Summary:
Hirschmann EagleSDV industrial networking devices are affected by a high-severity vulnerability that could compromise the security of critical infrastructure.

Vulnerability Details

CVE-ID: CVE-2022-4986

Affected Software: Hirschmann EagleSDV

Affected Versions: Version 05

Vulnerability: This vulnerability affects the Hirschmann EagleSDV, an industrial firewall and security appliance. While the specific technical details are limited, the high CVSS score suggests a significant flaw that could allow an attacker to bypass security functions or gain unauthorized access to the device.

Business Impact

In industrial environments, a compromise of a security appliance like the EagleSDV can have catastrophic consequences, including the disruption of physical processes and damage to equipment. With a CVSS score of 7.5, the risk to operational technology (OT) environments is high, potentially leading to safety risks and significant downtime.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Hirschmann immediately to address this vulnerability in EagleSDV version 05.

Proactive Monitoring: Monitor the management interface of the EagleSDV for unauthorized login attempts or configuration changes.

Compensating Controls: Isolate the management network for industrial devices and use multi-factor authentication (MFA) to protect access to critical security hardware.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. This late disclosure of a 2022 vulnerability highlights the importance of maintaining an inventory of all OT assets and their patch status.

Analyst Recommendation

Immediate remediation is critical for any vulnerability affecting industrial control systems. Organizations should update their Hirschmann EagleSDV devices to the latest secure firmware version to protect their critical infrastructure from potential exploitation.

Description Summary:
A firewall bypass in Hirschmann HiLCOS OpenBAT and BAT450 products allows IPv6 IPsec VPN traffic to circumvent configured security rules.

Executive Summary:
Hirschmann HiLCOS wireless devices are vulnerable to a critical firewall bypass that allows unauthorized network traffic to circumvent security policies in IPv6 IPsec environments.

Vulnerability Details

CVE-ID: CVE-2021-4477

Affected Software: Hirschmann HiLCOS OpenBAT and BAT450

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: When using IPv6 IPsec (IKEv1 or IKEv2) alongside an IPv6 internet connection, the device fails to apply firewall rules to VPN traffic, allowing it to bypass policy enforcement.

Business Impact

This flaw allows unauthorized traffic to enter protected network segments, potentially leading to data breaches or unauthorized access to internal resources. The CVSS score of 9.1 reflects the critical failure of a core security component (the firewall).

Remediation Plan

Immediate Action: Apply the latest HiLCOS firmware updates to all affected OpenBAT and BAT450 devices to restore proper firewall enforcement for IPv6 traffic.

Proactive Monitoring: Audit network traffic logs for unexpected IPv6 connections that should have been blocked by existing firewall policies.

Compensating Controls: If patching is delayed, consider disabling IPv6 or IPsec functionality if they are not critical to operations, or implement secondary firewalls behind the Hirschmann devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. This vulnerability specifically affects IPv6 environments, which are becoming increasingly common in industrial IoT.

Analyst Recommendation

A firewall that can be bypassed is a significant security failure. Organizations relying on HiLCOS devices for secure remote access via IPv6 must update their firmware immediately to ensure their security policies remain effective.

Description Summary:
A late-disclosure vulnerability in Hirschmann HiOS devices prior to version 08 poses a high-severity risk to network infrastructure security.

Executive Summary:
Older versions of Hirschmann HiOS firmware are subject to a high-severity vulnerability that could facilitate unauthorized access to industrial network devices.

Vulnerability Details

CVE-ID: CVE-2020-37216

Affected Software: Hirschmann HiOS

Affected Versions: Hirschmann HiOS devices versions prior to 08

Vulnerability: This vulnerability affects legacy versions of the HiOS firmware. Although it was disclosed late, the CVSS score of 7.5 indicates a significant flaw that likely permits an attacker to bypass security controls or impact device availability.

Business Impact

The presence of this vulnerability in industrial switches can lead to unauthorized network control and potential disruption of critical OT processes. The high severity reflects the risk of long-term exposure in environments where firmware updates are infrequently applied, potentially leading to persistent unauthorized access.

Remediation Plan

Immediate Action: Immediately upgrade all Hirschmann HiOS devices to version 08 or higher to remediate this long-standing vulnerability.

Proactive Monitoring: Conduct a thorough audit of network device logs for any historical signs of unauthorized access or unusual configuration changes.

Compensating Controls: Implement network segmentation to isolate vulnerable legacy devices and use hardware-based firewalls to restrict management traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: This is a late disclosure of a 2020 vulnerability. As of April 4, 2026, there is no public information indicating active exploitation, but the age of the flaw increases the likelihood that exploit methods may be known in closed communities.

Analyst Recommendation

The age and severity of this vulnerability make immediate patching mandatory for any remaining legacy installations. Organizations must transition away from HiOS versions prior to 08 to ensure the security of their network infrastructure.

Description Summary:
A buffer overflow in the Hirschmann HiSecOS HTTPS login interface, occurring when RADIUS is enabled, allows remote attackers to crash the device or execute arbitrary code.

Executive Summary:
Hirschmann HiSecOS devices are vulnerable to a critical buffer overflow that allows remote attackers to achieve code execution or cause a permanent denial of service.

Vulnerability Details

CVE-ID: CVE-2018-25237

Affected Software: Hirschmann HiSecOS

Affected Versions: Prior to 05.3.03

Vulnerability: When RADIUS authentication is active, the HTTPS login interface fails to perform bounds checking on password inputs. Submitting a password exceeding 128 characters triggers a buffer overflow.

Business Impact

An attacker can exploit this to gain remote code execution or render the security device inoperable (Denial of Service). Given the CVSS score of 9.8, this represents a critical threat to the availability and integrity of the network security perimeter.

Remediation Plan

Immediate Action: Update HiSecOS firmware to version 05.3.03 or later. If updating is not immediately possible, consider temporarily disabling RADIUS authentication if an alternative exists.

Proactive Monitoring: Monitor system logs for device crashes or repeated failed login attempts involving unusually long character strings.

Compensating Controls: Use a Web Application Firewall or specialized IPS signatures to drop HTTPS POST requests to the login page that contain excessively long password fields.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. The specific condition (RADIUS enabled) must be met for the vulnerability to be reachable.

Analyst Recommendation

Buffer overflows in authentication interfaces are highly dangerous. Administrators must prioritize the firmware update to version 05.3.03 to ensure the stability and security of their HiSecOS deployments.

Description Summary:
An authentication bypass in Hirschmann HiOS and HiSecOS products allows unauthenticated remote attackers to gain administrative access via specially formed HTTP requests.

Executive Summary:
Multiple Hirschmann networking products are susceptible to a critical authentication bypass in their management interfaces, permitting unauthenticated remote administrative access.

Vulnerability Details

CVE-ID: CVE-2018-25236

Affected Software: Hirschmann HiOS and HiSecOS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The HTTP(S) management module fails to properly handle authentication status, allowing unauthenticated attackers to hijack the privileges of previously authenticated users through crafted HTTP requests.

Business Impact

An attacker gaining administrative access to industrial networking equipment can intercept traffic, modify network configurations, or cause significant operational downtime. The CVSS score of 9.8 reflects the critical nature of this vulnerability, as it allows for complete device takeover without valid credentials.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Hirschmann for all affected HiOS and HiSecOS device models immediately.

Proactive Monitoring: Monitor management interface logs for unusual login patterns or HTTP requests originating from unauthorized network segments.

Compensating Controls: Disable HTTP/HTTPS management interfaces on untrusted networks and utilize out-of-band management or VPNs for administrative access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of an older flaw, which often increases the likelihood of exploit development as technical details become public.

Analyst Recommendation

The ability to bypass authentication on core industrial networking hardware poses a severe risk to infrastructure stability. Administrators must treat this as a high-priority remediation task and update all affected devices to the latest secure firmware versions.

Description Summary:
An improper authorization vulnerability in Hirschmann Industrial HiVision allows authenticated read-only users to bypass access controls and gain unauthorized write access to managed devices.

Executive Summary:
A critical privilege escalation vulnerability in Belden Hirschmann Industrial HiVision allows restricted users to modify device configurations, posing a significant risk to industrial network integrity.

Vulnerability Details

CVE-ID: CVE-2017-20238

Affected Software: Belden Hirschmann Industrial HiVision

Affected Versions: 06.0.00 through 06.0.05, and 07.0.00

Vulnerability: This flaw is an improper authorization vulnerability (CWE-285) that permits an authenticated user with read-only privileges to perform unauthorized write operations. By interacting with the web interface or SNMP browser, an attacker can bypass intended access control mechanisms to modify managed device configurations.

Business Impact

The ability for a read-only user to escalate their permissions to write access directly threatens the operational integrity of industrial control systems. Unauthorized configuration changes could lead to network disruption, service degradation, or the introduction of malicious settings, justifying the high severity of the 7.1 CVSS score.

Remediation Plan

Immediate Action: Upgrade to Hirschmann Industrial HiVision version 06.0.06 or 07.0.01 immediately to resolve the authorization bypass.

Proactive Monitoring: Audit network access logs for anomalous configuration changes or unauthorized management requests originating from accounts with restricted user roles.

Compensating Controls: Restrict access to the web interface and SNMP browser to trusted management subnets until the software can be patched to reduce the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires existing authenticated access, the impact on industrial environment stability is high, necessitating prompt patching.

Analyst Recommendation

Given the potential for unauthorized configuration changes in sensitive industrial environments, organizations must prioritize upgrading to the fixed versions. Ensure that all Hirschmann Industrial HiVision instances are updated to at least 06.0.06 or 07.0.01 to eliminate this authorization flaw and restore proper access control enforcement.

Description Summary:
An authentication bypass in Hirschmann Industrial HiVision's master service allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges.

Executive Summary:
Hirschmann Industrial HiVision software contains a critical authentication bypass in its master service, allowing unauthenticated remote code execution with full administrative rights.

Vulnerability Details

CVE-ID: CVE-2017-20237

Affected Software: Hirschmann Industrial HiVision

Affected Versions: Prior to 06.0.07 and 07.0.03

Vulnerability: Exposed interface methods in the master service fail to enforce authentication. An unauthenticated remote attacker can invoke these methods to execute commands on the underlying operating system.

Business Impact

This vulnerability allows for complete control over the network management station, potentially leading to the compromise of the entire industrial control system (ICS) environment. The CVSS score of 9.8 reflects the extreme risk to operational technology (OT) environments.

Remediation Plan

Immediate Action: Upgrade Hirschmann Industrial HiVision to version 06.0.07, 07.0.03, or higher immediately to close the exposed service interfaces.

Proactive Monitoring: Inspect network traffic for unauthorized calls to the master service and monitor the host operating system for unexpected process execution.

Compensating Controls: Isolate the Industrial HiVision server within a secure management VLAN and restrict access via a firewall to only authorized administrative hosts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. However, as a late disclosure of a critical RCE in an industrial product, it should be treated with the highest urgency.

Analyst Recommendation

Unauthenticated remote code execution on a network management platform is a "crown jewel" vulnerability for attackers. Immediate patching is mandatory to prevent catastrophic unauthorized access to critical industrial infrastructure.

Description Summary:
GarrettCom Magnum 6K and 10K switches contain an authentication bypass via a hardcoded string. Unauthenticated attackers can gain full administrative access to switch configurations.

Executive Summary:
GarrettCom managed switches are subject to a critical authentication bypass vulnerability due to a hardcoded string, granting unauthenticated attackers full administrative control.

Vulnerability Details

CVE-ID: CVE-2017-20234

Affected Software: GarrettCom Magnum 6K and 10K managed switches

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from a hardcoded string within the authentication mechanism of the switch firmware. An unauthenticated attacker can exploit this string to bypass login controls and access administrative functions and sensitive configuration data.

Business Impact

A successful exploit allows an attacker to take complete control of the network infrastructure provided by these switches. This can lead to traffic interception, network outages, and unauthorized configuration changes. The CVSS score of 9.8 reflects the catastrophic risk to network integrity and availability.

Remediation Plan

Immediate Action: Update the switch firmware to the latest version provided by GarrettCom to remove the hardcoded authentication bypass.

Proactive Monitoring: Monitor management interface logs for successful logins from unusual IP addresses and audit configuration changes regularly.

Compensating Controls: Restrict access to the management interfaces of these switches to a dedicated, isolated management VLAN with strict ACLs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of a legacy issue, but the technical risk remains critical for unpatched hardware.

Analyst Recommendation

Hardcoded credentials in networking hardware represent a severe security failure that allows effortless compromise of the network backbone. Administrators must identify all GarrettCom Magnum switches in their environment and apply firmware updates immediately. If patching is not possible, the management interface must be completely firewalled from the rest of the network.

Description Summary:
Hirschmann HiLCOS Classic Platform switches are affected by a high-severity vulnerability in versions prior to 09, impacting industrial network reliability.

Executive Summary:
Legacy Hirschmann HiLCOS Classic switches contain a high-risk vulnerability that could allow attackers to disrupt or take control of industrial network traffic.

Vulnerability Details

CVE-ID: CVE-2016-15058

Affected Software: Hirschmann HiLCOS Classic Platform

Affected Versions: Versions prior to 09

Vulnerability: This vulnerability affects the Classic Platform switches (L2E, L2P, L3E, L3P). As a late disclosure of a 2016 vulnerability, it highlights a long-standing flaw in the switches' operating environment, likely related to administrative access or network protocol handling.

Business Impact

The compromise of industrial switches can lead to the total loss of visibility and control over manufacturing or utility processes. A CVSS score of 8.1 indicates that an exploit could cause significant operational downtime and potential safety risks in industrial environments.

Remediation Plan

Immediate Action: Update all affected Hirschmann Classic switches to HiLCOS version 09 or later immediately.

Proactive Monitoring: Use industrial IDS/IPS solutions to monitor for unauthorized configuration attempts or unusual management protocol traffic (e.g., SNMP, SSH) targeting these switches.

Compensating Controls: Ensure that management interfaces are strictly reachable only via secure, isolated management networks and use strong, unique credentials.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. Legacy industrial equipment often remains in service for decades, making late disclosures like this particularly dangerous for unpatched environments.

Analyst Recommendation

Immediate patching is required for all affected switches. Industrial operators must ensure that their patch management lifecycle includes legacy networking hardware to prevent exploitation of known vulnerabilities like this one.

Description Summary:
Hirschmann HiLCOS industrial networking devices are affected by a high-severity vulnerability in versions prior to version 8, potentially impacting critical network infrastructure.

Executive Summary:
Hirschmann HiLCOS devices, including OpenBAT and WLC series, are susceptible to a high-severity vulnerability that could lead to unauthorized access or control of industrial networking equipment.

Vulnerability Details

CVE-ID: CVE-2015-10148

Affected Software: Hirschmann HiLCOS

Affected Versions: Versions prior to 8

Vulnerability: This vulnerability affects the HiLCOS operating system used in various Hirschmann industrial wireless and controller products. Although this is a late disclosure of a 2015 vulnerability, the flaw likely impacts core administrative or communication functions, potentially allowing an attacker to bypass security controls.

Business Impact

The impact on industrial control systems (ICS) is significant, as these devices manage critical wireless communications and network logic. A successful exploit could lead to network downtime, interception of industrial data, or unauthorized configuration changes, justified by the High CVSS score of 8.2.

Remediation Plan

Immediate Action: Upgrade all affected Hirschmann devices to HiLCOS version 8 or higher immediately to resolve the underlying security flaw.

Proactive Monitoring: Implement deep packet inspection (DPI) on industrial network traffic to identify anomalous management traffic directed at HiLCOS devices.

Compensating Controls: Isolate industrial wireless controllers within dedicated management VLANs and implement strict Access Control Lists (ACLs) to limit device exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. This is a late disclosure of a legacy vulnerability, which often indicates that while the vendor has addressed the issue, unpatched legacy systems in the field remain at high risk.

Analyst Recommendation

Given the critical role these devices play in industrial environments and the High CVSS score, immediate remediation is required. Organizations should conduct an inventory of all legacy Hirschmann equipment and ensure they are running supported, patched firmware.