CVE-2018-25236
Published: Apr 3, 2026
Modified: May 14, 2026
CVSS v3.1
9.8
Description
Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.
| Vendor | Product | Versions |
|---|---|---|
Belden | Hirschmann HiOS | affected 0 - <= 05.07affected 0 - <= 06.1.04affected 0 - <= 06.2.00unaffected 06.1.05unaffected 07.0.00+1 more versions |
Belden | Hirschmann HiSecOS EAGLE | affected 0 - <= 03.00.02unaffected 03.0.03 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now