What’s Vulnerable › Vulnerabilities

CVE-2016-15058: Hirschmann HiLCOS Classic Platform Password Exposure via SNMP

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-03 · updated 2026-07-21
• Weakness: CWE-257

Description

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.

Affected products

• Belden Hirschmann HiLCOS Classic Platform: through 09.0.05; through 05.3.06 — fixed in 05.3.07, 09.0.06

How to fix

Upgrade to a fixed version: Belden Hirschmann HiLCOS Classic Platform 05.3.07, 09.0.06. Check the vendor advisory for mitigations.

References

• https://assets.belden.com/m/1d8273c6205dc400/original/Security-Bulletin-Password-Sync-SNMP-v1-v2-BSECV-2016-12.pdf
• https://www.kb.cert.org/vuls/id/507216
• https://www.vulncheck.com/advisories/hirschmann-hilcos-classic-platform-password-exposure-via-snmp

Get alerted when CVE-2016-15058 or the next vulnerability affects your stack