Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2018-25236

Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Belden Hirschmann HiOS

Default version status: unaffected

  • 0 to ≤ 05.07affected
  • 0 to ≤ 06.1.04affected
  • 0 to ≤ 06.2.00affected
  • 06.1.05unaffected
  • 07.0.00unaffected
  • 03.1.00unaffected

Belden Hirschmann HiSecOS EAGLE

Default version status: unaffected

  • 0 to ≤ 03.00.02affected
  • 03.0.03unaffected

References