Read the docs
TI-2017-14301 Aliases CVE-2017-20237GHSA-27cv-h3wc-24hg

Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution

Priority MEDIUM 50CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00978 62nd percentileScored 2026-11-07
Fix Fixed Hirschmann Industrial HiVision (Belden): 06.0.07, 07.0.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BeldenHirschmann Industrial HiVisionup to 06.0.06; up to 07.0.0206.0.07, 07.0.03Patch availableCNA
  • Hirschmann Industrial HiVision VendorBelden Affected up to 06.0.06; up to 07.0.02 Fixed in 06.0.07, 07.0.03 Patch available CNA

Remediation

  • Fix · CNA Hirschmann Industrial HiVision (Belden) Fixed in 06.0.07, 07.0.03

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-20237
  2. 2026-10-03 Alias added: GHSA-27cv-h3wc-24hg

References

Advisory 1

  • TI-2019-09143 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2019-09145 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. CVSS 3.1HIGH 8.8
  • TI-2022-19123 The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command… CVSS 3.1HIGH 8.8
  • TI-2019-09144 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. CVSS 3.1CRITICAL 9.8
  • TI-2019-09148 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2025-43113 A stored cross-site scripting (XSS) vulnerability exists in the web management interface… CVSS 3.1MEDIUM 6.1
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences