What’s Vulnerable › Vulnerabilities

CVE-2018-25236: Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-03 · updated 2026-07-21
• Weakness: CWE-287

Description

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Affected products

• Belden Hirschmann HiOS: through 05.07; through 06.1.04; through 06.2.00
• Belden Hirschmann HiSecOS EAGLE: through 03.00.02

References

• https://assets.belden.com/m/52ecadbb5f1b0e04/original/Security-Bulletin-Web-Server-Authentication-Bypass-HiOS-HiSecOS-Hirschmann-BSECV-2018-05.pdf
• https://www.vulncheck.com/advisories/hirschmann-hios-hisecos-authentication-bypass-via-http-management

Get alerted when CVE-2018-25236 or the next vulnerability affects your stack